The minimal fix

I have no quarrel with the fix that removes the in-place operation entirely, but shouldn't there be a fix for all levels of the exploit chain? The underlying bug, as I understand it, is with the crypto_authenc_esn_decrypt() function writing extra bytes past the end of the memory it was meant to decrypt. Shouldn't there be a patch fixing that first of all?