Prototype pollution can happen when objects are used as maps, and the key names can come from user data (or are otherwise open ended). We should guard against this by preferring Object.createObject( null ) over {} when creating such objects.