Comment by nostoc

Yeah, because statically typed language never had any kind of deserialization vulnerabilities.