https://blog.rust-lang.org/2021/11/01/cve-2021-42574.html has a nice clear example.

Full Stack Chris reviews some code that he thinks says:

    if access_level != "user" { // Check if admin

This may be an open source project. This may be an internal bad egg (a very common threat; insider jobs are actually one of the absolute top risks to a company). Or this code may be injected by an attacker who has gained access to the repo and is leaving backdoors that they hope to survive long after their access is blocked or leaving backdoors to make deployed production systems vulnerable. Etc.

And Chris won't notice that the computer will execute:

    if access_level != "user{U+202E} {U+2066}// Check if admin{U+2069} {U+2066}" {

This is not just an attack on compiled languages. Scripting languages are just as vulnerable.