The first point about template injection almost seemed like it was going somewhere, but actually feels like a no brainer to avoid, since every flask/jinja tutorial under the sun is going to tell you to use curly-brace placeholders in your templates, and not python's built-in substitution operators/methods.

When I think vulnerabilities, I think of something inherently flawed with the design and implementation of something that can be easily exploited, even when used perfectly as intended. For example, if there was a way for someone to inject code into the template even when used with all common sense template syntax and loading techniques.

Since Jinja/Flask were designed to handle untrusted input sanitization well, this is more of a "gotcha" than a "vulnerability." If you use the tools available to you appropriately, it's not a problem. If you misuse or don't use the tools available to you, you risk accidentally creating vulnerabilities unnecessarily. That sort of goes without saying.