Tl;dr if your code takes user input and interprets it as code, you have an inherently insecure program. Dynamic languages with lots of introspection made their

Tl;dr if your code takes user input and interprets it as code, you have an inherently insecure program. Dynamic languages with lots of introspection made their work easier here, but the whole reason it was possible is because the program was intentionally insecure. The "restricted environment" was a few small hacks on top of eval, it wasn't a serious attempt to make it secure.