>it is trivial to construct URLs that execute arbitrary code on a web surfer's machine.

Forget the design, it's "web surfer" what gives the old page age away.

Joking aside, they've put more thought into the tel URL scheme, that allows you to start a phone call on iOS, by disallowing the use of * and # [0].

0.https://developer.apple.com/library/content/featuredarticles...