One the one hand: Yes, if it's not your code then it's not exactly your responsibility to fix. On the other hand: As a user, the takeaway isn't "well that's no

One the one hand: Yes, if it's not your code then it's not exactly your responsibility to fix. On the other hand: As a user, the takeaway isn't "well that's not their fault", the takeaway is "if I use this software, then I am vulnerable to this problem". The question of who's responsible or where the fault lies is irrelevant.