So why did the patch for this vulnerability come FOUR YEARS LATER?