> That doesn't sound right to me; its legitimate topic that a package where the core use-case is X, that package has obscure feature Y, and the mere existence of Y can cause security issues for a user even when the user never intended to use it.

In this case it is not clear at all whether the feature is obscure. For most people it could be actually essential and the primary requirement for the whole software.