Hence my usual advice to just avoid the shell [... and only use it if one knows what one is doing.]

Sounds a little like advising people to wear condoms at all times rather than just when appropriate.

That's a pretty good analogy for what I said: If one knows and trusts one's user, one doesn't need to "wear a condom" and can put their input into the shell unprotected (although it can still be useful to prevent accidents). But if one is going to be sleeping with the entire internet...