It's totally realistic, knowing I've found multiple CVE myself doing exactly this method 5000x (we do loops that way almost everyday) in very serious softwares including Bun, Node, LXD, Openresty and so-on.