Whenever you run one of these tools on a file you downloaded from the Internet, you're relying on the tool having no exploitable security bugs. Regardless of whether or not $PAGER was intended to be a "load bearing security component", it definitely is.