I got to wondering, based on the sendmail discussions, how many shell
escapes have appeared over the years?

uucp
sendmail
xdvi : "The "allowShell" option enables the shell escape in PostScript specials"

There must be a lot of them, however.