Reading that point reminded me of a recent article where a security researcher found an exploit due to the URL parser in Safari:

Unauthorized access to cameras in Safari on macOS and iOS - https://www.ryanpickren.com/webcam-hacking

And another one related to URL parsing:

The unexpected Google wide domain check bypass - https://bugs.xdavidhu.me/google/2020/03/08/the-unexpected-go...

No, it's not the root cause, though it did exacerbate it. See the comment in https://news.ycombinator.com/item?id=22890633.