Most of these technologies provide tools to make code safe, and generally make it easier to be safe than not to be (templates escaping by default, expression languages[0] and ORMs[1] making non-escaping code longer and more complex than escaping codepaths, etc...)

That does not seem to be the case here, not in the tools, and not in the culture.

[0] http://www.sqlalchemy.org/docs/core/tutorial.html

[1] http://www.sqlalchemy.org/docs/orm/tutorial.html

Yes, but in very few cases are the server- and client-side languages the same one.

For the purposes of security, I don't think that matters.

It does help explain the temptation of jamming client JSON right into a JSON object store.