Here's the Rails Guide on the Mass-Assignment "Issue"

This is documented behavior, right?

If someone did not read your documentation, and submitted an issue about known behavior, would you be inclined to change your application because of it? Or, would you be inclined to close the issue and ask them to read the documentation?

If a high-profile website also did not read or implement your documentation, does this mean there is a vulnerability in your application because your users did not secure their websites as a consequence?