I would argue that it's orders of magnitude more difficult by way of comparison to simply injecting naughty bits into an HTTP response.