Back in the day plain ASCII wasn't really secure,
either.
No need to use the past tense. I had a need to assess how much
damage one could do if allowed to feed arbitrary text into xterm.
I came away sobered.
Do not--ever--use a mail agent which will plumb unfiltered text
through to an xterm. nmh, for one:
http://savannah.nongnu.org/bugs/?36056
Andy