Assuming good coverage and excellent sanity checking if the pipes get contructed following user input.
printf syntax is trivial when compared to shell intricacies. Think of all the possible extra expansion and quoting problems this could cause. But yeah, that's mostly for the developer to worry about.