With the greatest of respect I don't care about the average programmer anymore. People can be incompetent in all sorts of languages. I care about my own work.

With the greatest of respect I don't care about the average programmer anymore. People can be incompetent in all sorts of languages. I care about my own work. I've implicitly mentioned "ease of deployment" myself in this thread, I think, and probably in others, and I don't care for the assertion. I suggest you ask the others who have, what they mean. "Secure by default" is a big claim. Secure against this particular problem you identify, sure. But let's not over-egg the pudding; there are still vulnerabilities in popular Python frameworks.