This is much more interesting than all of this soap opera about Theo.

What we see in this commit, regression, and vuln is that the X server is an enormous setuid program with tons of code and zero tests. The "fix" also does not contain any tests that could have detected the problem, so it's just a continuation of what is now a quarter-century of bad software engineering practices.