I think this is essentially an incentive to upgrade the organization. Free organizations consist of people with the same domain name in their email addresses (i.e. company.com), but there’s no administrator for the entire organization. This means anyone can declare themselves the administrator as long as they’re willing to pay. The flipside, though – the advantage to us – is that an individual team can decide whether to upgrade to premium without all the other teams/users having to pay. This is an enormous cost savings for large organizations with varying levels of need for Asana throughout.
If you upgrade an organization or team, you have control over which paid seats are added because you have to invite or approve them.
Whether you have a premium or free organization or team, the only people who can view/edit/delete your stuff are the members of the organization, team, or project. It would be nice if certain members of projects could have more access control than others – right now the model is based a little too much on trust. But at least the members of the project are all colleagues who know each other – there’s no way for a stranger to gain access unless a member lets them.