Comment by ryanmccullagh

I would bet that a developer knew of the security issues, but was vetoed by Product.