"Victim blaming" is a little harsh when it's literally a developer not doing their job and letting arbitrary code get inserted into their product. Do your job

"Victim blaming" is a little harsh when it's literally a developer not doing their job and letting arbitrary code get inserted into their product. Do your job and make sure the code that's running is what you expect. There's no valid excuse not to.