That is the type of thinking that causes a massive amount of CVEs in those languages.

Hey, the design specs never said the program shouldn’t blast out and air raid siren at full volumn every time the user clicks a button. Cannot be a bug, must be user error.

People seem to forget that most of the open source language library code out there is written by people working for companies, being sponsored by companies or writing it so they can use it where they work. Some might start out as hobbiest projects but if it survives and grows it eventually will be sponsored in some form. Even if indirectly by some guy that wants to use it where he works.