Even if someone were impressively thoughtful about that, they'd still cough up arbitrary code execution on the web tier for most Rails / Django applications, by

Even if someone were impressively thoughtful about that, they'd still cough up arbitrary code execution on the web tier for most Rails / Django applications, by writing an appropriately serialized external command into the queuing system. That external command would be loading metasploit into /tmp and then gaining root with a local privilege escalation. Thomas is right, though: if you lose the DB, you're forked.