> Or they might have debug versions where they do use the safety checks and then for production versions it's preprocessed out.

Why would you do that? Most attacks will probably target your production environment rather than your development environment.