> We have literally decades of experience with these. We know for a positive fact that simple concatenation is dangerous.

Yes and no. I agree with the overall premise that the footguns are well documented, but at the same time, projects like this show that there are still large segments of developers who will gleefully shoot themselves in the foot because they never took the time to learn shell, or they just never had the opportunity to earn the battle scars.

At least Google has a bug bounty program.