Yes that’s one argument (the avoidance of system exploits through some data that is passed to the shell).

There’s also a portability argument.  Shell escaping varies between platforms (Unix/Windows), and also from one shell to another.

Moreover, manual shell escaping has always been a nightmare (how many backslashes to add?) that it is best to avoid it completely by letting the implementation do it automatically.  I wouldn’t like a system where the user has to worry about the possibility of arguments containing “$” and “\” and double/single quotes.

So for your use-case I would suggest:

> (define (pkg-config-lib name)
    (call-with-input-process
      (list path: "pkg-config" arguments: (list "--libs" name))
      read-line))
> (pkg-config-lib "zlib")
"-lz"
> (compile-file "test.scm" ld-options: (pkg-config-lib "libjpeg"))