The loan is zero-risk for the lender because it's taken out and repaid within the same transaction (sort of like a database transaction). If the borrower fails to repay, the entire transaction fails/reverts and the money is never lent out.
Now, the borrower doesn't only have to put the borrow and repay calls into that one transaction. They can put anything in between, for example interacting with Beanstalk.
I'm not much for regulation of crypto/DeFi in general, but instant lending like this should absolutely, 100% be illegal. It's exclusively useful for exploits and MEV vampirism, and for nothing else.
You can't cash out flash loans, they need to repaid within the same block. The only legitimate use case seems to be arbitrage/stablecoin stabilization.
Now, the borrower doesn't only have to put the borrow and repay calls into that one transaction. They can put anything in between, for example interacting with Beanstalk.