The commit diff shows critical validation was added to both functions: 1) Type checks for path segments (string/number) to prevent array-based type confusion 2) Explicit blocking of proto/constructor/prototype paths. The added tests demonstrate these were the vectors for prototype pollution. The vulnerability description specifically mentions array-based keys bypassing previous protections (CVE-2020-7766), which aligns with the missing type checks in these functions' path parameter handling.