[simonw]

Yes, they are worse - because if someone reports a SQL injection of XSS vulnerability in my PHP script, I know how to fix it - and I know that the fix will hold.

I don't know how to fix a prompt injection vulnerability.