I've seen both in security reviews, primarily driven by where the code fits in the application. The more modern apps that I've come across (with stronger coding

I've seen both in security reviews, primarily driven by where the code fits in the application. The more modern apps that I've come across (with stronger coding standards) restrict tag-based code to view templates.