It's a real thing: http://langsec.org/papers/langsec-cwes-secdev2016.pdf http://langsec.org/papers/langsec-cwes-secdev2016.pdf There are whole classes of error

It's a real thing: http://langsec.org/papers/langsec-cwes-secdev2016.pdf http://langsec.org/papers/langsec-cwes-secdev2016.pdf There are whole classes of errors related to programs that parse then validate input when it's already too late. And often the validation happens in the source code in a cloud of checks that happen at run time. It's rather difficult to verify these programs. It is much easier to verify a parser that only produces valid values at the edge of a program, isolated from the main program.