@Spamboy - You assume that everyone knew. When you read the code, everything looks good. Even when this problem was discussed on the Hackers list, some people didn't see the problem when shown the code and the way to exploit the problem.

Thus, no one noticed it, and it wasn't readily recognizable by doing a basic review of the code. However, this is something that is so readily exploitable that people were already doing it to numerous sites, this one included. It would have been extremely careless of the WordPress devs to not issue an immediate fix.