Because...that's what the PHP security team does?

No one needs to use their work, or indeed PHP at all.

But that's why the PHP security team exists.

If it takes 2 months to do fix a massive security issue, it's best if someone else steps up to the plate to fix it.