They're not being harrassed. You're basically saying that because FFmpeg doesn't have enough resources to fix all the security vulnerabilities, we should fix it by pretending like there are none.