Bizarre policy. Any bad guys unaware of the security implications are analyzing the patch diffs as we speak, so this seems nonsensical to me.