Honestly, I think it's great that this all gets aired out in the open. The amount of transparency behind all of this is a breath of fresh air.
Rails has had its share of growing pains; it really sucks that a security patch had a regression and I think this gave people a lot of flash backs to the pre Rails 3 days. By the end of this, however, we'll end up having a solid security infrastructure.
I'm willing to wager that 90% of the time these kinds of issues just get swept under the rug and silently patched.