It's clear that Amazon did think about XSS -- in the context of the browser. The debugCmd isn't available there.
It's also clear that tney didn't think about all the other potential interactions with the system. It's not the things you don't know that bite you -- it's the thing you know that isn't so.