Luckily modern UNIX-based systems are rarely used as multi-user terminals these days or we would see many more privilege escalations via exploiting bugs in scripts which iterate over user owned files. Even in web scenarios, most web frameworks carefully manage what is allowed in a filename or set the filename themselves.
Ultimately because on UNIX there is no type, you have to make assumptions. These assumptions are sometimes dangerously wrong. You can definitely write scripts and execute commands in a more secure way, but you can go google Linux tutorials right now and find tons of examples where newbies are taught to do it wrong out of the gate.
Data types make this "secure by default." String for everything requires the script-writer or command line-writer to be perfect every time they hit return.
[0] http://www.defensecode.com/public/DefenseCode_Unix_WildCards... [1] https://www.helpnetsecurity.com/2014/06/27/exploiting-wildca...