Security hardening for Debian

For format string attacks, why isn't there a simple option to just disable "%n" processing
entirely?  So few applications actually need it.  You'd still be vulnerable to information
disclosure if you process an untrusted format string, but an actual exploit capable of running
external code should be nigh impossible without %n.