Because...that's what the PHP security team does?
No one needs to use their work, or indeed PHP at all.
But that's why the PHP security team exists.
If it takes 2 months to do fix a massive security issue, it's best if someone else steps up to the plate to fix it.
If it takes 2 months to do fix a massive security issue, it's best if someone else steps up to the plate to fix it.