Earlier quoted context omitted.
I think the cases where it's still a hole are probably obscure and/or unlikely in the wild, but I definitely think the response to this should have been to disable the feature altogether. It's a terrible idea and I'm really curious if anything actually uses it and should be using it .
It's used to export functions from one instance of bash to a child. Do you think that that's a terrible idea, or do you have a better idea of how to implement it? (The fix changes it so that exporting is done through specially named variables. Instead of exporting `x='() { :; };`, it now exports `BASH_FUNCTION_x()='() { :; };'`.)
It would take actual use cases to convince me it's not a terrible idea. No matter what it's a mechanism to throw arbitrary code into a script that has no say in it. This is not the sort of thing you should do because it seems cool, it should be the sort of thing you do because of a really compelling use case that necessitates it. The fact that afaik no other shell has implemented this behaviour since bash did (a couple of decades ago if I understand correctly?) would rather suggest there is a lack of need for this.