I think if I was dumb enough to leave display_error on in production, I'd have a bigger problem with crackers being able to figure out sensitive details about my system from said error messages than worrying about them injecting scripts into them. Not saying that I have not seen this in the wild, but I have zero sympathy for those that don't carry out these basic steps to secure their production servers.