Hacker News Reader

It's a vulnerability. No one wants it (except attackers).

Of course there are some situations that some people actually do want (controlled) remote code execution, such as ssh.

The latter.

I've seen a few cases. (Not that they were justified, but that it was a very convenient way to program by someone at the time)

The use case here being you fully trust another developer to use the API properly, not realizing a user could also use the API.

Now, code review with a security perspective is usually enough to stop intentionally adding it.