I'm not sure that I would say "vendors are bad for security", but I think the practice of distributions applying a load of patches to upstream software is very unwise. Patches are warranted when they are backporting upstream changes or for integration with the rest of the distribution, but random changes (as this one was) shouldn't be made by the distributor -- they should be fed back to the upstream authors, who are in the best position to assess whether or not the change is sane. Furthermore, when a distribution changes something but doesn't feed those changes back upstream, it creates incompatibilities between different distributions of the same upstream package. For example, in the past the FreeBSD PostgreSQL port had all sorts of wacky patches (like changing the block size, or using the ICU library) that weren't accepted upstream, which lead to exactly this problem. Although the patches were optional, this is just not a game that vendors should be in.