also, security enforcement through the code/data dichotomy is only as good as the engineers involved - there's a long and rich history of discovering bugs which can get stuff imported as data placed someplace it doesn't belong, and subsequently read as code, and also a distinguished history of people creating, apparently without realizing it, ‘data’ formats that are actually code.

and these are going to be government engineers. probably Social Security Administration or IRS engineers.

and then we have to trust said government engineers not to deliberately compromise your security for their own or their masters' evil purposes, although i suppose certain political measures could make that sufficiently unlikely.