I find it really interesting that they snuck the patch in to a commit months ago. Are there any other examples of something like this happening where maintainers had to obscure changes to the software?
This is the de-facto route for closed-source software, but Linus doesn't mark all security patches as such [0]. There are a lot of unpatched systems out there and Linus doesn't have the time to parse the exact ramifications of every security bug.
That being said, it's pretty clear that we need to invest in more robust software development methods.
It's inherently problematic because you need to somehow get your users to upgrade their software without knowledge of exactly why they need to do this.
I know Bitcoin has had denial-of-service fixes sneaked in, but I'm not aware of anything of this nature.
One thing's for sure: the commit logs of crypto-currencies will be scrutinized a lot more by black hats from now on.