Isn't this a general class of problem that has a similar risk profile for any type of gateway that accepts inputs that are not very tightly bounded?

Not only LLM services.

I'm running a gateway for my local LLMs, are you opening it to the internet? Who's going to craft a malicious payload?