James, they try to fix lilypond 2.18, not 2.20 or master.
2.18 is still insecure.
At this point of time we probably really need to decide to release
2.20,
come hell and high water, including its current faults.
Or pitch out 2.18.3. At the very least it might make sense to add
purely compilation fixes (for keeping up with more current versions of
compilers etc) to the current stable branch in future even if one does
no proper release. Possibly even security fixes. That way there is
some semi-official way of dealing with bit rot. Also makes it easier
to
do regression testing 5 years later.