yes, that's a limitation of most internal DSLs.*

Perl has some means to disable/override built-ins but normally the possibility to extend the internal DSL is considered a feature.

Just try to define a JSON format with the same flexibility and start hacking a DTD which is validating it, to see what I mean.

In the end this might turn out to be the better approach but designing a DSL works out much faster and could be used as a preliminary step.

Especially if the design needs to be adapted constantly you'll never reach the phase to finalize a JSON format.

update

*) in the case of Rex you are distributing centralized configs via SSH. But if the centralized server is compromised you are already in much deeper shit.