Doing some security work now. And it seems half of my problems are because some other site get to run any random code so they might call my site. And I have to

Doing some security work now. And it seems half of my problems are because some other site get to run any random code so they might call my site. And I have to protect against that. I am somewhat annoyed. Why is this design acceptable in first place?