> The PHP security team, operating on consensus, struggled to choose between these and feared the repercussions of shipping the wrong choice.

This is the real story. You ship one of them (the breaking change) with —fuck-my-shit-up or something as a compile time option to switch to the other fix.