I'm not sure why the UDID would eever have been exposed to app developers. It seems the API should offer an ID that was the result of the UDID run through some sort of hash seeded by project or at least developer cert.
I agree with the seeded hash of an UDID. A developer can track one user across handsets, but two different developers can't tell form the hashed uid if it is the same customer.
This solves both the problems of 1. developers having to implement full blown account/login systems if their app is offering subscription services when a simple user id would suffice and 2. not allowing the user to be tracked across services.
I think this was just bad design from Apple.