It's easy to imagine a chain of changes, starting from innocuous string substitution with static strings in the code base and gradually building up to downright

It's easy to imagine a chain of changes, starting from innocuous string substitution with static strings in the code base and gradually building up to downright exploitable network access and multiple substitutions, all based on the previous changes as precedent (we already do substitutions, this is just one more). That's not to say it shouldn't have been obvious, but string substitution using functions can have non-obvious impacts as functions call functions which are then modified later by someone else to do crazy things like network calls or parsing code for the sake of convenience. You see the same in say rails templates which might fire off dozens of expensive sql queries to a database and without changing the template but just changing one of those methods on a model the entire performance profile can change - nobody is to blame exactly, but the entire system makes it easy to shoot yourself in the foot.