The guy forgets the main thing here: length, type and range checks!

I'm finding issues like API servers hanging/crashing due to overly long or malformed headers all the time when I work on front-end projects.

Programming in a language with automatic range and type checks does not mean that you can forego vigilance even with the most mundane overflow scenarios: lots of stuff is being handled outside of the "safe" realm or by outside libraries.