React 19 RCE vulnerability - can we stop pretending modern frameworks are automatically more secure?