How does nodeos' abi_json_to_bin exactly work?

From telegram I’ve been told that using abi_json_to_bin from a wallet can be problematic (leaves you open to MITM attack, if someone intercepts and gives you a bad action data to sign, for example).

I’ve been trying to implement it myself, but am at a loss of where to look. I’ve looked at eosjs2 source code, as well as the chain plugin source code (which seems to call the abi generator source code) but they’re either really hard to understand – since I’m not a javascript developer, or really complex and depends on many other parts of the source code – which is quite huge.

The first step seems to be to grab the ABI specs of the smart contract’s method. After that you’d try to serialize using the struct which has the name of the method, as the spec.

But how exactly do objects/arrays get serialized? I can see from https://github.com/EOSIO/eosjs2/blob/master/src/eosjs2-serialize.ts#L518 that individual types have their own ways of serialization, but I’m totally not sure about what happens when it comes to arrays/objects.

I suppose I could just reverse engineer by trying different combinations and how they affect the binargs output, but I thought I’d ask here first