It certainly would have been nice if the XSS hole was found during the 2.8.1 cycle, that would have been one less update -- but for stuff like security holes, you issue the update, even if it has been one day since the last update was issued. Of course, if 2.8.1 was what introduced the bug (I honestly don't know), then that says something else.