It's X11 which is asking applications what was selected when determining what will be pasted from middle click. To be secure X11 should be maintaining its own buffer which can only be updated via user interaction instead of relying on every application to implement this security measure themselves.
It's also a security issue with the shells that are interpreting a pasted new-line character. The author of that post is delusional to claim that none of the blame should be placed on the shells.
