Formula injection is the section most export code gets wrong, because escaping only a leading equals sign misses plus, minus, at, tab and carriage return. Prefixing those cells with a single quote is the common OWASP recommendation, but it does change the value, so it is worth making it an explicit export option rather than a silent default. For nested arrays, emitting a second linked CSV often reads better in a spreadsheet than flattening into numbered columns.