I only noticed it when a slew of security holes (re-)introduced by uncritical merging of LLM code got CVEs assigned.

Luckily I was lazy running a custom build of vim and hadn't updated since they started lowering the merge barrier (or however you can put this politely).