Is the brotli decompression step really the most dangerous vector on the client-side? What about all the non-verified client-side native code that actually inte

Is the brotli decompression step really the most dangerous vector on the client-side? What about all the non-verified client-side native code that actually interprets file data? From a practical perspective using the C code doesn't deteriorate existing conditions and using the Rust code doesn't improve them.