If you are referring to the Ruby YAML vulnerability, the problem is that the deserializer ends up calling methods on the deserialized object. This says it doesn't, it merely warns you against doing it yourself, or at least doing it carelessly.

Not so much. With YAML it's a feature baked into the syntax that you have to go to extra effort to avoid. With JSON, it's just a specific data schema you opt in to, so a non-aware decoder will just give you a Hash with some odd data in it.