Ruby on Rails: Changeable model ids on vanilla update can lead to severely bad side-effects

Proof of concept User.find1.update!id: 1701 But strong params! Disagree. There are cases where less experienced users will allow "id" as a param for a subnested resource and then copy and past that code into that subnested resource's own controller, forgetting to remove the "id". I consider this...