Because every implementation of anything has certain assumptions and when you're not someone who regularly juggles different scripts at once it's easy to miss a

Because every implementation of anything has certain assumptions and when you're not someone who regularly juggles different scripts at once it's easy to miss a lot of things (e.g. blindly assuming that everything is ASCII). Also part of the problem was U+0027 and its use as a quote character in shell scripts. So that was not a Unicode issue but rather a shell script injection issue and programmers do that all the time (although usually with SQL, I guess).