Assuming that fixing existing String APIs (e.g. first) is unacceptable (due to backwards-compatibility constraints), are there new APIs that could be introduced to at least provide the ability to work around the existing flaws? (e.g.)
I think the heart of it is some way to 'lazily' compare strings, meaning comparison algorithms that don't work on whole graphemes only but are smart enough to abort on the first byte that determines the result of the comparison. Thus closing the door on attacks like absurd numbers of repeated combining characters.
I don't have a good idea what this would look like, API-wise, but the need is pretty clear.