“Worse, macOS 27.2, released on 26th October, did not fix the issue and undid the workaround that users had applied by hand, leaving them vulnerable again.”
Volunteer projects patched this days ago. Apple, with more cash than most countries, shipped an update that undid the fix users applied themselves. Safari is protected. The git, curl and python3 that every Mac developer uses are not. Anyone on the network path can hand you poisoned code and walk off with your GitHub token.