Does not specifying the charset in the content-type of the http response header lead to vulnerability, even in modern web browsers (Chrome, Firefox, Edge) as of 2022?
I read the following article, but as of 2022, due to the efforts of web browser vendors, XSS attacks using utf-7 are no longer valid, and although garbled characters may occur, they will not be a vulnerability.
https://owasp.org/www-project-web-security-testing-guide/latest/6-Appendix/D-Encoded_Injection
Security Vulnerabilities without <meta chartset=<<"any-encoding">> /> tag?