If the behavior is just that BC will 'match CN when no dNSName SAN exists' when it shouldn't, then I don't know if that is really a security issue for us.