Surprise surprise...
About as surprising as seeing completely content-less anti-systemd comments like yours popping up, really.
Surprised that software has security flaws? Especially software written in "let-me-use-that-chainsaw-to-trim-the-bushes" C? :)
I know that there will be security flaws in any language, but if there ever was software today that deserved a safer programming language, the init system was it. Or the web browser.
The 'fixed' code¹ has the property that calling it to create a file with mode==0 (i.e. no permissions) actually creates one with mode==0644 (i.e. some permissions), which is a wtf r u doin that can't be blamed on C.
¹ https://github.com/systemd/systemd/commit/06eeacb6fe029804f2...