You don't need structure for secure control though, as long as the control channel is isolated. It's easier to make an insecure program when dealing with loosely described text streams, but it's by no means inevitable.

Doesn't have to be text.