There is no "safe" standard, but command line is primarily designed for users, not applications. It almost by definition requires extra scrutiny. But the issue

There is no "safe" standard, but command line is primarily designed for users, not applications. It almost by definition requires extra scrutiny. But the issue here was not the command line. It was not handling the interface properly. Somebody wrote a 5 minute hack to handle security functionality and probably didn't even read the application source to look for proper use, much less version checking. The same thing happens with APIs. And null terminated strings have worked for 40 years, that doesn't have anything to do with this.