One other small bit... There is some precedent for retaining modules where the underlying library was known to be buggy. The dearly departed bsddb module exposed libdb 1.85 (as I recall) which had an unfixable bug. Still, bsddb supported that broken version of the library for quite awhile before itself being deprecated, then removed, from the stdlib. I believe it was the sole persistent key/value store for most of the early years.
So, bugs or not (& fixable or not) it's not like we haven't encountered this kind of case before.