I mostly agree, but as usual there are the classical catches:

1. yeah you can do that, but we should really do some (most? all?) of the things you mention (as well as other safeguards) mandatory

2. your code might be alright, but what about your dependencies ?