The injection you can't review your way out of
Code injection gets stopped at the seam where data becomes code, by refusing a whole syntactic class rather than weighing each case. It holds wherever that boundary is decidable, which is the exact property natural-language prompt injection never has.