Fun fact, BSI has that sending out security emails when they find a security hole. A client once got that and was on the edge. It was a bit odd, cause the article they linked to literally said this wasn't affected (so no patches existed). Really wished they didn't do that. It was OpenSSH on OpenBSD.

There were other laughable things like that.

But in a world dominated by FUD (that HTTPS connection that only allows one fingerprint needs to go over VPN, that SSH port cannot allowed to be reachable (but that gaping hole on HTTP(S) is fine), without a firewall that server is insecure, ...) that's not exactly surprising.