It's more like how having JavaScript enabled in a browser is "in principle incompatible with untrusted execution". That is to say, yes, you are technically righ

It's more like how having JavaScript enabled in a browser is "in principle incompatible with untrusted execution". That is to say, yes, you are technically right, but at the same time the benefits are great so we are still pursuing that approach while at the same time fighting an arms race of finding and closing any security issues this design introduces.