But the fact is that it is a protocol flaw (deliberate choice or not).

The Guardian should have inserted caveats stating that this flaw is highly unlikely to have been exploited, but I would argue that not telling the people of the flaw is as bad as telling them that it's backdoored.