I'm not sure what exactly you missed, 'cause I missed it too.
I don't see how C++ is more vulnerable to a "type a bunch of characters" attach than, say, C. A std::string is guaranteed (I believe, I'll double check with the standard later maybe) to be able to hold whatever the size of the stdin buffer is. And processing 16 + 1000000 (the C-fixed buffer way) is no better or worse than processing 1000000 in one shot. And of course you can't overwrite any memory the C++ way, as far as I can tell.