The harness is a security threat because it's vibecoded but the code you're having agents write for you isn't? Lol
I don’t vibe code though, to the extent I actually use agents to generate code it all gets reviewed and it’s essentially exactly what I would have written myself. It’s mostly things like mechanical refactors, boilerplate generation, etc.
I think it is more on distrusting python/typescript in general. Those dynamic scripting language are too easy to poison.