Neither is the opinion that "This problem exists because someone wrote a tool that should only do one (really well) and but instead made it do five different things."

You can make security bugs in simple tools - this security bug is not purely a function of the number of target use-cases.

Nor do you have any rational basis for asserting that the given app "should only do one [thing]".