I wouldn't necessarily
forbid bug fixes to
all things marked as legacy. For some things, like RandomState in numpy, it's warranted because very strict bug-for-bug backwards compatibility has some desirability. For most things that are legacy, the main point is just that bug fixes are at the bottom of our general priority queue. But sometimes a quick fix is simple enough that it rises up on
someone's priority queue. So committers
SHOULD close bug
reports on legacy components, and committers (and especially release managers) MAY veto legacy-bug-fixing PRs that are contributed, but could also accept them.