ISTM that in order to run you code, a person already has to have the ability to run arbitrary code.

The purpose of the existing checks was to support the use-case where the field names are taken from the header line of CSV files.

I would be happy to add a test for exact string inputs but will not throw-out the current design which has a number of advantages including the ability to keep just the generated code and throw-away the factory function itself.