It's all trade-offs. No one likes breaking software. In this case, it's a security issue, so that can justify a breaking change.