Yep, for sure. One of the things we see most frequently leading to code execution is still deserialization... but it's much more rare now, so a step forwards from my point of view.