There are ways to fix these issues while preserving legacy client support. And honestly I don't see how changing their database mess would help in solving security issues. In the end they'll have to change their API to a more secure one, which will definitely disrupt client support for future updates