That is an interesting idea, and on first blush I do think it'd be safer, but it does rely on figuring out exactly when the flaw was introduced, and will result in the "YoYoing" of features, which is confusing from a consumer standpoint.

POCs are a part of any good bug disclosure. It should be easy to test that one is no longer affected. Besides, trying older versions to undo problems is a very old and reliable technique.

I get that, but when you roll back, you don't really control what else you're removing, and you're implying that a roll back wouldn't break other parts of the system, or that it even makes sense, given the state of the system (it could be years before a vuln is noticed).

Imagine waking up one morning and realizing you can't use uppercase on your file names anymore because of a rolled back vulnerability.