This is good advice in general, but Rails used the wrong kind of parser for this kind of data. JSON is not YAML. A YAML parser does not provide the same guarantees as a JSON parser about its output. It doesn't matter if both parsers are completely correct if you use them inappropriately.
My understanding is that YAML is supposed to be highly general-purpose and is not supposed to be resilient to malicious input. These aren't YAML parser bugs, these are framework bugs that pass malicious data to the YAML parser when that parser should never be exposed to it. And that in turn appears to be entirely due to an extremely overly-helpful and magical nature of the framework.
Nope, the problem is not due to the magical nature of the framework.
They implemented the JSON decoder with a JSON to YAML converter, passing that through the YAML decoder.
The fix involves using an actual JSON parser and skip the going through YAML part. So it does qualify as a JSON parser bug, IMO (which is what I clumsily attempted to imply with my "(or JSON)" clause above.)
You are free to dislike Rails design, but you can't blame it for some vanilla parser bug.
Parsers are fertile ground for bugs, because they are by definition exposed to arbitrary input.