You're not wrong. Had Debian not patched it in this way, OP might have never found it, leaving all other distros who do the same vulnerable.

Note that OP found this in Debian sid as well, which means it's highly unlikely this issue will find its way into any Debian stable systems.