Well, then that's library dependent and not an intrinsic part of the language. So shipping Lua safely would mean having to swap or drop parts of the standard library for something a bit more robust.

Apparently, that's what Lunatik does so the work seems to already have been done.