I reported this. Curiously, they patched (but didn't disclose) the more severe half of this bug. Calls to `Model.where(params).create` also don't protect again

I reported this. Curiously, they patched (but didn't disclose) the more severe half of this bug. Calls to `Model.where(params).create` also don't protect against mass-assignment. I believe this pattern is both much more prevalent and hard to detect.