I think programmers' editors in general have treated "automatically run arbitrary code supplied by files you're editing" seriously as a security vulnerability since sometime around 2000.

(For example, Emacs realised that 'local eval' wasn't a good thing to have enabled globally in Emacs 19, in 1994, and spent the next decade or more closing many other loopholes involving local variables specified directly in files.)

If modern editors and IDEs are no longer thinking that way, I think that's a mistake.

build.gradle can contain arbitrary Groovy code with full system access, and needs to be executed to figure out the project structure.