What would you have a security team for then?

Well... Based on the response to this incident, I think you're asking a great question!

What value did the security team add? Seemingly none. In fact, it seems they actively delayed the response; if the report/fix had come through as a normal MR, they would have fixed it weeks ago.

To handle the official solution and drive long term changes to reduce similar security bugs from happening again. The current PHP security team does not seem capable to promptly release a fix, so having a community fix first seems preferable.