Stealing local files using Safari Web Share API

Besides the fact that I'm always torn if vulnerabilities should be published if the vendor has committed to fixing them: I don't quite understand why a fix can't make it into the next big release that's around the corner (macOS Big Sur and iOS 14). Do large vendors really have such long development pipelines that changing anything is impossible for months? Or do they just have thousands of similarly serious issues and need to prioritize?

It seems that the protection against this attack is being able to recognize that the file that's attached isn't the one that's intended but I think it's a mistake for the local filename and any fs metadata to be preserved when sharing by default. Sharing a file should mean sharing only the content of the that file.