Encoding and decoding are both transforms on attacker supplied input. I don't think its helpful to armchair quarterbacking other peoples mistakes that ended up

Encoding and decoding are both transforms on attacker supplied input. I don't think its helpful to armchair quarterbacking other peoples mistakes that ended up in a vulnerability when the overall code quality is good. There are a dozen ways they could have done it differently, which may or may not have resulted in different exotic bugs. Punycode was the footgun here. Not the language, or the implementation, or the code. They were forced to do something stupid and complex and dangerous deep within the bowels of a critical library.