This note reminds me a lot of when there was push back on "lint" or compiler warnings. that sense of "yeah, there's a code smell, but I can't see the bug so I'll ignore it" is real, and not good for our practice. (Thinking in particular about how someone trolling Github found a $dbi->param(...) without a scalar coercion in the Flutterby content management code, and it didn't look exploitable, but I fixed that so fast...)