Being an accidental or curious tap away from an RCE isn't actually much better. The fix is using sanitizing and safe parsers.