To be fair, there has been very slow progress toward securing some endpoints. But yeah, I was probably being too charitable; the project places way too much emphasis on “backward compatibility” and not enough on security.