for sure, there's awareness and then there's disregard of any basic web security.

the second they start hosting any application/backend/cookie-enabled thing on this domain name, anyone could inject a script via their /post/ gzip-base64 scheme, and do bad things...?

I don't think html sanitization would go against the principle of this idea. just... at the very least strip the tags! :-)