Not backporting to security-only branches as it only affects installers, which we don't build for security-only branches.

Shipping the installer or not is irrelevant, someone building a security release from source shouldn't end up with a7.2 CVE on their hands out of the box.

Someone buildingfrom source wouldn't be using the prebuilt binaries or probably even the exact process we use to build the macOS / Windows installers. If there are people doing that, they probably have specific requirements for their own environments anyway. They should definitely vet and consider all the third-party dependencies they're building against.