> What's not exploitable is when you don't have a frontend at all, or your frontend isn't doing any kind of request parsing

I think that’s exactly what he was trying to say in the first point. Anyway thanks for stressing that, it helped me understand better what is happening.