He was basically, 'it's a feature not a bug'. And 'it's expected that people using this library know about security.' Which I guess doesn't include him because his own example was vulnerable.
Madness string 96035
Maybe folks won't accept it exactly as you envision it right now, but if you only ever make what you envision at the start, your process is BAD.