The point isn't that they had a security flaw, it's that the patch release fixing it changed the god damn default ORM's semantics!