It's not a "call arbitrary external program" feature, but an "object serialisation" feature that has security implications which some implementers did not handl

It's not a "call arbitrary external program" feature, but an "object serialisation" feature that has security implications which some implementers did not handle correctly because of their language parochialism and lack of experience. That does make it closer to an unfortunate (but entirely avoidable) accident rather than what you believe, that evil people maliciously and intentionally added a backdoor. You can keep believing it, but that does not make it any more true.