I think the security issues come from parsing text rather than stdout itself. I vaguely recall reading about such an issue a year or two ago.