Obviously you are right... but...
If the fix had been some super application specific super obscure thing, we would all understand.
Instead... the bug is easily describable to anyone who knows what JSON is and the fix is “don’t parse JSON the slow way”.
So I think some of the leniency afforded to the devs may be misplaced. Then again, hindsight and all that.