Data-only attacks ... have long been considered too sophisticated and niche to pose a practical threat.

I thought the whole point of fuzzing was an example of finding data-only attacks.