I agree with your premise but filtering fields selected by the database, or serialized into JSON, isn't exactly an unsolved problem. It's probably easier to muck up true... but it's not hard to prevent either.