Even if they read the news, and they updated to the latest build of ioquake3, they wouldn’t have caught the follow-up security commits to the code repository unless they downloaded another test build more recently.