I would have thought that would be true of all patches? They potentially close the stable door after the horse has bolted.

I also don't think that
It sounds like functionality beat security here
which implies that there was some sort of trade-off?

It seems more like the method was not well thought out. I can accept that they can't tell the difference between good and bad WPAD entries, but letting users believe that the patch has been applied successfully is the real sloppiness in my book.

Sure I can understand MS wanting to record that the patch was attempted and ran without error, otherwise updates would be forever trying to re-apply it.

I would have thought that the simplest solution would be to send a message that that the update ran successfully but action was not taken because WPAD entries existed?