No alternatives were provided. We should, what, leave any vulnerability identified by China as-is? Just because it's possible that a fix may contain a logic bo

No alternatives were provided. We should, what, leave any vulnerability identified by China as-is? Just because it's possible that a fix may contain a logic bomb should not rule out the fix. The author of a software change is less important than the merit of the contents in the change.