YAML allows escapes to executable code?
!!python/object/apply:os.system
args: ['ls /']
!!python/object/apply:os.system
args: ['ls /']
Authors of some libraries did not consider the security implications of the object serialisation part of the spec. I assign the blame to them for not looking beyond their own limited horizon, metaphorically speaking. When they made their libraries, the reference implementation was already available and it was secure by default.
That does make it closer to an unfortunate (but entirely avoidable) accident rather than what you believe, that evil people maliciously and intentionally added a backdoor. You can keep believing it, but that does not make it any more true.