macOS's built-in Terminal.app protects against this attack too. If I try and paste the text containing the bracketed end mode character, Terminal.app beeps and

macOS's built-in Terminal.app protects against this attack too. If I try and paste the text containing the bracketed end mode character, Terminal.app beeps and presents a sheet telling me that I cannot send the text to the terminal because it contains invalid content for Bracketed Paste Mode (along with a more detailed description). Incidentally, when you say iTerm2 "does this" do you mean the simple "confirm paste" behavior, or does it actually explicitly protect against the bracketed paste mode attack?