So, it's essentially argument injection?

I dislike these tools so much, because you need to know all these corner-cases and I don't.

Yeah, this happens broadly in shell with globbing. It's a bit ridiculous.