In fact, it’s neither, it’s coreutils (gnu, yes) `date`. My point is that seemingly innocuous system utilities do make for exploit targets, because folks shell to them.

Yes, you can lock things down with jails/containers, but it’s a valid target. Defense in depth, and all that jazz.