I wouldn't want to risk something this critical being in my project. I'm stupid so I try and limit my own attack surface against myself.
I think the embedding part is certainly a tradeoff. Once the development community settles on a best-practice for things like this, it becomes less of a danger of forgetting. For example, once this sort of config shows up by default in archetypes and boilerplate projects, I feel that the danger is reduced to the level of being manageable. And hopefully the port that the editor uses is blocked by default in the production environment. :)