@viktor I think that this is just plain statement just because you have to proof your point somehow. Unfortunately for you we are not stupid. You might think otherwise but we know what we are doing.
The only CVE fix in newer versions of 4.4.x I could found was CVE-2019-19332 and that is for X86 and KVM. That means not affecting us.
And regarding mwan in 3.x? Fixing something is not done in mere of seconds. It is moved because it is not yet fixed and we do not know when end if it is going to be fixed. Automatic migration might come before that. Here and there we look in to this issue but it has lover priority than fixing CVEs you know. And we do not have unlimited manpower to fix everything in single release. We release fixes as soon as they are tested. We do not wait for all fixes to be ready as that makes no sense.