From what I understand the vulnerability is not on lower() but on using different Unicode rules version for it

That sounds to me like a better explanation