So, at work, you find out a library you're using is insecure. Do you:
1. Submit a bug report to the library and then do nothing else, for over a year, with no end in sight, and say it's not your problem, you can't fix it, and there's nothing you can do, and you wont tell your users.
2. Address the problem by fixing the library yourself, or getting somebody else to actually fix it, switch to a different library, patch over the problem on your applications side?
If number 1 is your answer, you probably shouldn't be distributing software.
I'll let Balsa and Geary know about the preconnect problem. Will be interesting to see if they take the same awful approach that Evolution Mail did to addressing it.
[edit]