Equally, one could argue a 'good' developer would not in any way be put off by an example that demonstrated good security practice. And 'good' needs to be put

Equally, one could argue a 'good' developer would not in any way be put off by an example that demonstrated good security practice. And 'good' needs to be put in context: e.g. a 'good' hardware or kernel engineer who never wrote front-end stuff may legitimately be unaware of the need to defend against SQL injection unless its written somewhere. If they're as 'good' as you're expecting they would probably not even require a getting started tutorial... Anyway, this is something I see in many tutorials and its somewhat unfair to single out Lucee. I just wish tutorial writers would put effort into real-world examples more often.