sed only sees data from the user, so the only person in a position to leverage that attack surface is the user himself. It will never touch any part of the net

sed only sees data from the user, so the only person in a position to leverage that attack surface is the user himself. It will never touch any part of the network, or handle any untrusted input. So this is not a concern.