To support this JSON patch format, you've got to implement a system which validates that all the array entries are in a valid format, securely interprets the 'path' attribute, and processes the rules according to a specification which may or may not cover every edge case
To support my approach, you need to validate that each line uses a strict subset of JavaScript, then securely evaluate each one according to the well defined rules of JavaScript.
Both have basically the same essential complexity - not sure I see why the JSON format patch is inherently 'easier' to work with.
