It is wholly inappropriate to start blaming these authors, or to even suggest they are malicious (which is even worse). They are the ones the technical compute

It is wholly inappropriate to start blaming these authors, or to even suggest they are malicious (which is even worse). They are the ones the technical computer community that operates at this level of network implementation have "chosen" to do this work (or they've chosen themselves, which is practically the same thing) which is an honour to them. If anything goes wrong here, it is that culture at large, the way the RFCs get debated and approved, etcetera. There is no one to blame here in isolation. Although I will agree with you that it is remarkable that this person forgot to write the check on payload_length after stating that so explicitly in the document.