Webform on 'hostile development' environment A client has a 'hostile development environment' and, related to this, a list of 'blessed modules'.

One of the hard/fast rules is 'no Webform' module.

(The only answer given to 'Why?' so far is, "If the answer is Webform, you're asking the wrong question," by the Devops people who guard this hostile environment.)

Is this a justified exclusion in any way and how would you respond to this statement/exclusion?

Our use case is for a single, simple contact form which allows users to submit their email address, a Subject and a body (in plain text only).

And the reason I'm asking this is so I can explain to 'stakeholders' (also on the client side) what's going on. Devs on my side are mystified.
Coming from a huge production environment with Drupal multi-site running, the Webform can be a constant headache if there is no SPAM protection turned on, or if modules/core aren't kept up-to-date.  Maybe they had problems in the past with Drupal admins not running protection on their forms and not keeping their modules up-to-date with the latest security fixes?  Also, Drupal, the Webform module and open-source CMSs in general have a bad rap with the IT/Security crowd.  I have experience it more than once in my career.

The best thing you can do is find out why they feel the way they feel about that particular module, and then explain to them how, if maintained correctly and used correctly, it should be of little to no concern.