My very obvious rebuttal: Shellshock was introduced into bash in 1989, and found in 2014. It was incredibly trivial to exploit and if you had shell, you had root perms, which is insane.

env x=‘() { :;}; echo vulnerable’ bash -c “echo this is a test”