After being in place since at least February 2004, when KDE 3.2 was released. Someone want to explain that "many eyeballs" business to me again?
What are you suggesting? "Many eyeballs" translates into instantaneous discovery? How long did the WMF vulnerabilty exist before discovery? Hint: It was much longer than two years.