I confess that I'm at a bit of a loss to know what sort of side effects would be common when serializing something? Is there an obvious class of reasons for this that I'm just accidentally ignoring right off?
I think it's less about side effects being common when serializing, just that their fast path avoids anything that could have side effects (like toJSON).
The article touches briefly on this.
That said, I see that they called it out as you say, now. When I first read it, I thought they watched for side effects.
I'm assuming they have an allow list on all standard types. The date types, in particular, often have a toJson that seems like it should still be used? (Or am I wrong on that, too? :D )
People have exploited this sort of side effect to get bug bounties before via type confusion attacks, iirc.
That getter looks inoffensive and will, depending on your requirements, work just fine. But it has side effects because the string interpolation allocates and could trigger a garbage collection.
Note that if you're using modern JS 'class' blocks a 'get x ()' will be ignored by JSON.stringify, so if you're aiming to reproduce this you have to use old-school Object.defineProperty instead.
I'm sure there are plenty of other similar uses that I just don't know about.
That said, if this is really included computed fields, that seems far broader.