Likely it's simply prohibitive (and a poor user experience) to track WebKit upstream and deploy firmware updates every time a vulnerability in the engine is patched