I'm sure its 'less bad' now -- but here's an example of an absolutely horrendous security-bug-as-a consequence-of-design-deeply-baked-into-rails ... https://github.com/rails/rails/issues/13420

Interestingly -- the rails developers decided to put in a really horrendous hack to mitigate the common paths through which this design-flaw might lead to unexpected security outcomes ...

In a way, one could argue that the willingness to put in a horrendous hack to 'mitigate' a security flaw provides an example which demonstrates some amount of 'security reasonableness' in rails ...

In reality tho -- I think that this example serves as evidence more for the fact that rails is deeply flawed and very unlikely to be secure in practice -- for reasons of design complexity alone.