On the other hand, fish being a clean-room shell implementation not beholden to the baggage of legacy systems is immune to some crazy behaviors or vulnerabilities that other shells - including zsh - are prone to: https://yossarian.net/til/post/some-surprising-code-executio...
Compatibility has also come a long way in recent releases; you should give it a try.
In bash, this would also print "hahaha" with "a" (or any other possible variable name) instead of "PWD", that's why many think it doesn't work at all in zsh.
I'm pretty sure zsh has an optimization where it skips the indexing if the variable doesn't exist, which happens to sometimes stop this. But since you can just reference variables like PWD, that you know exist, it's not really a security improvement.
Compatibility has also come a long way in recent releases; you should give it a try.