hmm, this may be why i just saw an unexpected update to a very old theme.

It's not clear to me: do we need to both apply the patch _and_ check if our themes are vulnerable, or just apply the patch?

Edit: looking at the patch itself it looks like it fixes the root cause and so it shouldn't matter what themes are doing themselves. But possibly I'm reading it incorrectly.