One is that the perfect garden can be created overnight, which it can't.
The steady state of disks is full.
No amount of source-level verification or scrutiny will protect you from using untrusted code.
I wanted to avoid, special IO for terminals.
You can't trust code that you did not totally create yourself.
I wanted to separate data from programs, because data and instructions are very different.