I'm confused how those changes to the contact form module improve security. It appears to be just adjustments to user permissions, but the contact form data is stored in the form of a shortcode, and the page being edited should control those permissions anyway.

I'd already done a full audit of those code in there for a previous project. I didn't think there were any problems in that section at the time, and I'm still confused as to how the change is an improvement. It seems to be just doing the same job twice, but perhaps I'm missing something obvious :/