Being affected downstream means it's a security incident regardless? I don't understand why you think this is misleading, incomplete context in the title? Sure.