You should be allowed to customize the whitelist; such whitelisting should not be hard-coded.
And here we go again with "but that was the old, evil MSFT! This is the new, good MSFT!" Where oh where have we seen this before? Hello leopard, nice spots. (Cue whataboutism)