While the DoS of accounts-daemon is bad, it seems like the real problem here is that gdm3 running with broken/absent/etc. accounts-daemon will believe there are no accounts even though there may be? Surely this is extremely trusting behaviour on gdm3's part and should also be fixed?

But all the updated versions are for accounts-version, not gdm3. Do they change the 'default' response somehow?