Clarification: 1.2.10 "single quote"

1.2.10 Verify that the application is protected against CSV and Formula Injection.
The application must follow the escaping rules defined in RFC 4180 sections
2.6 and 2.7 when exporting CSV content. Additionally, when exporting to CSV
or other spreadsheet formats (such as XLS, XLSX, or ODF), special characters
(including ‘=’, ‘+’, ‘‑’, ‘@’, ‘\t’(tab), and ‘\0’(null character)) must be escaped
with a single quote if they appear as the first character in a field value.

• Relying only on RFC 4180 and the “leading character” rule may not protect against all injection scenarios, because different applications can interpret CSV data in different ways.
• Escaping with a single quote at the start isn’t always the best or only defense, especially for more complex formats that have their own structures and formula parsing rules.
• As far as I know RFC 4180 describes how CSV files are structured,it doesn’t address security measures like escaping for formula injection or other spreadsheet-specific risks.
• A single quote escape is not a universal solution.
• The requirement also doesn’t clearly define its scope. This mitigation is only necessary when user-provided data is included in CSV/XLS output. If all the content is system-generated and trusted, this escaping may not be needed.

Start by reviewing requirement 1.2.10 in the ASVS 5.0 source and compare its CSV and spreadsheet guidance with RFC 4180. Resolve the intended scope, supported formats, and whether single-quote escaping is sufficient, then update the requirement so its security expectations are unambiguous.