And then PHP (name your lang/OS/platform of choice) comes along and pulls your sufficiently locked down app into the gutter.

This is more fundamental than better input checking. Your compute substrate itself is flawed. Intelligence and speed is indeed the only thing between “safe” and “completely open”.

I fully agree it’s a good idea to be minimal etc but I don’t see it being sufficient in the long run.