I don't understand how they could classify CSV in the "less harmful" column -- its rules are insanely complex. Also, UTF-32 seems way simpler conceptually than

I don't understand how they could classify CSV in the "less harmful" column -- its rules are insanely complex. Also, UTF-32 seems way simpler conceptually than UTF-8, so I don't understand how UTF-8 ended up "less harmful" and UTF-32 ended up "harmful".