Yes. Just like the Log4j issue root cause. Too powerful and abstract features to wield securely.

Or maybe if we keep intent out of it; features were added in a time when we all worried less about security and internet implications. I would like to say ‘in the security dark ages’ but we are probably still in that era. ;)