Well, one could argue that the lesson from CVE-2017-0780[1] should've been "don't automatically decode rich messages from untrusted sources".

[1]: https://www.trendmicro.com/en_us/research/17/i/cve-2017-0780...