The security issue (non sanitized value being used) is know for more then 4 years, so what are two or three more months or years ... :(

The hack itself would not have been able to do any damage at all if wordpress would have kept user names confidential. So two old sins coming back together to bite someones ass.