i think this relates to the insecurity of exec.  since i didn't fully understand it, i added a larger comment higher up reminding us to ditch this once we add a query building interface