This fundamentally doesn't offer much advantage over a .toJSON() instance method and a .fromJSON() class method.
Don't say "security-focused" if you can't handle cyclic object graphs.