I don't think this prevent this exploit because it mergered by bot (BrewTestBot in this case).

An this exploit still working if any of contributor create malicious update