well .. that bugfix have associated a few risks..

1. let's suppose a user have a password: (note the space)

    " 123"

2. also you store the password using some hashing function, which prevents you from knowing the password.

3. two weeks later the bugfix goes live, the user cannot longer access the service.

Also, you cannot easily estimate how much benefit/annoyed users your _fix_ will endup having .. which makes it a higly risk change.