Patch has now been merged, seems the Full Disclosure process works, https://github.com/psf/requests/pull/6965