> The key issue is you can call into other objects which is unwise to do when used with untrusted user input.

This, and while in this case it is specifically unwise on security terms, there are plenty of other example where the feature are completely cosmetic and deviates from the core user requirements/scenario.