No need to quote a security expert to realize that. A language that mixes code and data as the same variable type, with only a single missing quote needed to t

No need to quote a security expert to realize that. A language that mixes code and data as the same variable type, with only a single missing quote needed to turn any variable into a full RCE. On top of that, add all the obscure syntax, stringly typed data for everything and with whatever measly error handling it actually does support being defaulted to off. Guess what you get.