Every piece of code in an operating system means a larger surface area for vulnerabilities, more support cost, more maintenance for both developers and the operating system maintainers, etc.
If you want to see how badly this can go wrong - look at Windows. Over a decade ago there were over a half a dozen different ways to represent a string in Windows and depending on which API you called, you had to translate between them.
Also, one of the earliest widespread vulnerabilities was caused by IIS not checking all of the different types of string encodings. You could literally pass DOS commands via the url bar just by encoding them and they would run on the server.