My assumption was that those security "challenges" were related to expansion (wordexp()) per se; not to the way wordexp() was implemented in this particular case.