That’s as much a vulnerability as <script> letting me pipe user input to it. Should I? Of course not. Can I? Yes. Is it a flawed feature for this reason? No.