These functions are called "protected functions" and may only be called from an untainted execution path (e.g. only from blizzard-signed code which has only received input from other blizzard-signed code). We inherit specific "secure templates" in the CreateFrame call which include a blizzard-signed OnClick handler that takes "frame attributes" set on the frame (which cannot be changed in combat) and calls protected functions based on that.