It's because the fix introduced the vulnerability, and only a small group of nodes were upgraded.
Yes, indeed. The pre-patch version didn't have length checks either, but it didn't matter with only (proof, commitment). A very well intended security patch that exposed a pre-existing flaw. Fucking hell software is hard!
1❤️2