This also adds an intriguing new dimensions to reviewing/verifying shell commands as benign and correct... How long until LLMs start (ab)using the trick in little requests they want me to approve?
There's enough complexity in the language spec that most people stick with a (fairly shared) subset.
Bash can be very powerful, but IMHO there's a certain point where I find it saner to accomplish the same thing via Python.
Disclaimer; author of this post, and also https://refp.se/articles/non-constant-constant-expressions and related post in that series.
I think there's a variable expansion syntax that does replacement, but I haven't learned it so I use sed.
I find that piping to a while loop is often simpler and more flexible than something like you've written, but maybe not in this specific case with the weird string replacement syntax. However, mine doesn't have a command injection vulnerability (that I know of).
A real scripting language can also do this easily:
for f in os.listdir("."): os.rename(f, f.replace("_","."))
Sometimes I'm tempted to make Python my shell. The fewer different syntaxes you need to learn for the same basic operations, the better!