I wonder if their statement that this was too complicated to be worth fixing when they found out about it in 2024(!) is perhaps also due to some shit a chatbot said
XFEDI
ActivityPubConversation
just theorycrafting a little here, from it being uhh fucking unhinged to sit on the RCE vulnerability that broke every install of your software all at once for 2 years until some crypto scammer leaked an exploit for it, because the fix was just too complicated to be worth it
so instead they did 13kloc while everything was on fire