In the end, a rushed patch to fix a security issue in the end hurts many user`s sites. Combined with automatic updates, this conspired to create a lot of collateral damage, perhaps more than the initial security hole may have in the same time period.

Making a significant coding and feature change in order to fix a security hole is always a challenge. It does point out the issues of automatic updates being very binary (yes or no, not much subtle adjustment), I understand the staff reasoning for what they did, but at the same time, I feel for the individuals, companies, and groups who woke up to horribly broken sites that could not be fixed as quickly as they were hurt. More so I guess because the nature of the security update is mostly to do with logged in users, and many corporate and private blogs do not allow user logins or submissions. They are likely users of shortcodes, and likely got most of the harm and little benefit.

Perhaps it`s time to start considering dependencies before applying an update.

I don`t use automatic updates for these reasons. It also keeps me from ending up on the x.0 versions that generally have a x.1 update within days.