I mean, that's certainly a great ideal. The real world is somewhat less-than. I don't fault anyone for having to maintain a legacy codebase developed by people who rolled their own, say, JSON-parsing functions. (If you want to see what this sort of exploit mitigation looks like in practice, see https://github.com/douglascrockford/JSON-js/blob/master/json... ; think that this was the most popular JSON parsing library ever. Thank goodness IE8 is a goner.)