Not doing it fully during a procedure call is an optimization. I responded to the comment with links from 2002 and 2005 that showed this along with proper way to save everything to memory. Shouldn't have been a surprise to someone reading up on it.

So they used a securely designed component and got bit anyway.

That wasn't the security features. It was the features not designed for security and targeting an audience wanting performance enhancements. The kind of thing that often leads to unexpected problems. ;)