Hi, Richard.
You're right. But it looks like there is sad MS-style truth here: 1) a lot of usecases use assumption about trusted intranet environment 2) nobody pays for minor optimization and bugfixes and most parts of functionality were written by main developers as a part of their work (and they have very little amount of spare time to make clean-up then). Community helps somehow to clean the code but this community is still not enough large to test everything enough. After all, criticism and bug reports are important things but patches are what really matters. It's do-ocrasy, isn't it?