By being moved to the main Wordpress branch, where everything has been known to be hackable since 1999, rather than staying in Tumbr's however-modified branch where probably some exploits don't work or have unexpected results.