You basically need to call a vote or ask the tech committee to rule otherwise if the maintainer says it's fine.

It's not really a bug if it's an advertised feature you don't like, so security team cannot do much in theory.

That's a bad policy then.