Oh shit, they intentionally left the real vulnerability out of the release notes and changelog. That's seriously fucked up. I stand corrected. After reading that, I believe their blog post. There was more to tge update than the disclosed 2FA patch.