The subsystem maintainer who merged io_uring dropped the ball. Part of merging any major feature is considering orthogonal concerns like security, logging, etc.
Instead of singling out a single person, I think it's more accurate to say the security community in general dropped the ball by not bringing concerns earlier to the maintainer who performed the merge(s).