Why is it a questionable decision? I do not see the risk it poses. Literally anyone including organizations far more well funded and vested than UMN are likely

Why is it a questionable decision? I do not see the risk it poses. Literally anyone including organizations far more well funded and vested than UMN are likely submitting hypocrite patches. At its worst, this research is merely substituting one existing bug with a new bug. And yeah, approval was sought after the research was conducted. Which itself will result in corrective action (very likely: training in human subjects research).