Review a CSV-building function for correctness and performance bugs

You are shown a short function (in Java or Python) that turns a table, a list of rows of string cells, into CSV text by appending to a string in a loop. Say what is wrong with its output and how it behaves on large exports, explain why, and give a fixed version. Expect to talk about escaping commas, quotes and newlines inside cells, trailing separators, and the cost of repeated string concatenation.