Let me put it another way: I contacted the security team, Nacin responded. Then a mix of human and technological error (he says it was an aggressive spam filter) led to a communication breakdown.
> Arciszewski's original patch wasn't merged because it was overly broad, lacked unit tests, and had whitespace problems.
The problem was that my subsequent updates that addressed these issues were met with radio silence. Now the developers have gotten actively involved and they're on version 9 (thanks to dd32). Since the FD post, their response has been largely professional, proactive, and conservative. I have no complaints there.
EDIT: Also, my follow-up post to FD about this: http://seclists.org/fulldisclosure/2015/Feb/53