You’re assuming users affected by this bug have control over the VM running their mail server. I won’t argue that it can’t be done, but it’s probably harder than we think.