downvoted for assuming that "chance of happening in random usage" has any correlation to what a determinated user will actually try to do.

This is like saying "oh, but nobody will ever insert SQL in our forms!"