Not many people realize both bash and zsh can add additional functionality through compiled extensions, and also debuggers like bashdb and zshdb exist.
That's why people carying about security shall compile their own bash and disable those features.
Doubtful. Do you? What's the exact script you use?