I’m still not seeing the security issue here.
If it was just a case of getting info from the database that wasn’t registered with acf then get_post_meta would have exactly the same problem. Or at least the issue could be fixed without removing old functionality.
It seems safer now to not use the plugins functions at all.
