Job payloads are certainly not code; they're exposed to the developer as basically blobs of JSON, and the code lives in a "job handler" which is certainly itself not serialized.