We're sorry.

We've done our best to address the issue, provide the fixes for current versions as well as back-port it up to 3 years for all products running on the platform. In any case we apologise and have learned from this and will improve.

To JetBrains' credit they were very responsive throughout the disclosure process. I received a reply to my initial report in under two hours. Generally response times are measured in days unless you know someone in the company.

They also gave me diffs against intellij-community master so I could verify their fixes were sound, and they were generally receptive to my feedback.

While the bug is a downer, I was impressed with how they responded to it, especially the fact that they simultaneously released patch updates for all products (including Android Studio) and for all relevant prior versions. The email I got made the severity clear and I was able to easily update WebStorm, PyCharm, and Android Studio without any problems.

Updating has been painless, their communication was open and direct, and there aren't (to my knowledge) any exploits in the wild. How is this a failing on their part? Do you expect 100% perfection?

It is, but everyone can/will have vulnerabilities.