which only strengthens my argument, webp seemed like some ad-hoc pet project in chrome, and that ended like most unsafe binary parsers, with critical vulnerabilities
FWIW webp came from the same "research group in google switzerland" that later developed jpegxl.