Well, all rules can bypass the whitelist using executeCommandLine. If an attacker has enough knowledge to know this, they have enough knowledge to choose Rules DSL or JavaScript and use a Script Action instead of using Blockly. So I don’t think leaving it out of Blockly adds much security while removing an important capability. Also, making the Blockly implementation more secure won’t do much for security either unless all the scripts also implement something similar.
The discussion occurred back when the white list was first implemented for the Exec binding. I submitted a security issue and I don’t remember who all was on that thread. Since it was a security issue it want’ a public issue unfortunately so I can’t provide a link (can’t even find it right now)