There’s more to Emoji than meets the eye https://poststatus.com/the-trojan-emoji/

Jeff, hence the problem. A needed and required core fix "hidden" for no real good reason. They should have coded the fixes, put them in the next version update of WP, and boom, problem solves - and no extra security risks from Emoji use.

Emojis are a PERFECT plug in. They are absolutely not core material. This exposes the true issues of WP development right now. If you have a security problem, fix security. Don't lump new features in with a security fix hoping nobody notices, because the hackers diff the code on every update and they know every weakness on old installations a moment later. Trying to hide it makes it look even more vunerable.