Comment by hn_throwaway_99

That's absolutely not what leads to exploits like these. What leads to exploits like these is "Interpreting output from untrusted code (i.e. output from arbitrary commands) in a manner which allows execution of protected commands (i.e. setting env vars)". Which is like the primary reason for most security vulnerabilities.