“Everyone knew” that in-band signaling was an awful, horribly insecure idea… until we found magic math that couldn’t “think” any other way.

I don’t think it’s reasonable to blame the Unicode authors for not anticipating this turn of events.