How is a security issue "important" but not a high priority for development? Erm...what?