Or conversely, the shell injection vulnerability is fairly obscure — forgetting to validate the extension, not something you'd usually think of as user-provided

Or conversely, the shell injection vulnerability is fairly obscure — forgetting to validate the extension, not something you'd usually think of as user-provided input. This indicates that there was a modicum of concern for validation, they just weren't approaching it rigorously. It's a cause for suspicion of further vulnerabilities, but not confidence. One vulnerability is not two vulnerabilities.