You're right, but whenever I hear the words "Core Update" I usually think "Testing". For something this serious just getting that vulnerability patched asap seems like a good idea, especially if you look after a lot of drupal sites.

it might not be a one line change if you are on a version older than 7.31

It is. Same patch applies back to 7.0 (and even earlier).