How can AI cause harm if it can't manipulate the physical world?

What’s new and potentially risky is not the ability to build hinges, motors, etc., but the ability to build intelligence. Without a body, a human-level AI could make money on financial markets, make scientific inventions, hack computer systems, manipulate or pay humans to do its bidding — all in pursuit of the goals it was initially programmed to achieve.

None of that requires a physical robotic body, merely an internet connection — though if it needed robot bodies, a human-level intelligence could hack existing ones (there are numerous drones, cars, and robots connected to the internet) or hack one and use it to build more.