I get the frustration behind this, but “no defense” isn’t really accurate. The Mk3 flaw is serious, but it doesn’t retroactively invalidate every threat model or every mitigation people used. ...
pretty clear that they vibe coded the move away from the trusted GPL libraries that they were using so that they could change their license from fully open source to make it a non-commercial license (source viewable). Then they skipped on the security audit.