I think the rub is that all security bugs are bugs at the time of sale/update. Discovered or otherwise. But I agree with you here because at the time of sale,

I think the rub is that all security bugs are bugs at the time of sale/update. Discovered or otherwise. But I agree with you here because at the time of sale, this feature was widely agreed upon to be a bad practice and was also a known feature. So it's not like someone discovered a clever 0-day DLink didn't know about. DLink knew what it was doing, knew that best practices said not to do the thing it was doing, and did that thing anyways.