Because they operate on untrusted input