I just don't understand the threat model that gives attackers the most valuable RCE vulnerability in a decade, but denies them an ability attackers have had since 1996.