Patch applies files created with diff. Diff has 4 different output formats. One of those formats is basically a batch script with ed instructions.
For patch to work correctly you have to allow executing ed commands (internally or by spawning ed) but for security reasons you better not let ed execute yet another program.
% patch<evil.patch sh: 1: ed: not found patch: ed FAILED
patch works just fine for me, though, so ed is not required.