I agree. This is easier said than done. However, if a system is allowed to run scripts or arbitrary code without guard rails, all bets are off.