Looks like pcall and xpcall are listed as forbidden inside triggers and actions. Is the main suggestion to do nil checking in lieu of those being available?
they are for executing dynamically generated code, that's what wa use for triggers and custom functions, but giving access to them would bypass other stuff blocked