It isn't true that exploiting this would require a setting at the server level that would be considered insecure.

It also isn't true they are not getting out ahead of this. The vulnerable code, which was flagged by an automated security monitoring system, had been in the plugin for five months: https://www.pluginvulnerabilities.com/2023/08/07/code-that-leads-to-arbitrary-file-upload-vulnerability-in-stellarwps-kadence-blocks-has-been-there-for-5-months/