Are views safe to have other people editing them?

I have encountered a similar concern on our new CMF, written in CI4.

I have ended with creating FetchApi class to query tiers (every resource act like as a tier).

- API endpoints use this FetchApi with allowed fields and criterias.
- AdminControllers use this FetchApi with allowed fields and criterias.
- View files can access to $fetchApi object and can query any resource with API manner.

It's a lot of work but it decouples backoffice itself, api, frontend all together.

However, you are still on PHP. So yes almost all CI can be retrieved. But in views if you use Twig templates and not allow php inside, it might be the solution