There are well understood type systems and reliable compilers (some of them even proven correct) that can distinguish between "code" and "data", or between 'tainted' user input and 'escaped' / 'cleaned up' data. It's actually relatively easy.

Yes, today's LLM can not do this. At least not reliably.