I was confused what RFC 520 ("A Proposed File Access Protocol Specification") had to do with any of this. It looks like Theo meant to refer to RFC 6520: https://tools.ietf.org/html/rfc6520.
Thanks, I was going crazy trying to figure out the connection!
What does that have to do with this vulnerability? The problem was a missing bounds check in the implementation. It's not as though they suspect heartbeats are inherently insecure, right?