Actually, the takeaway is not about updates. Because the problem is actual intended functionality, that is "misused" for other purposes: indirect function calls.

So, the takeaway would be to control, which functionality is needed and which not, then to take action accordingly.