I don't see it as a flaw, but now that it's brought to light I think it deserves more investigation. I'd really like to see an open-source SD controller, maybe even one of the SD-to-raw-flash type.

But on the other hand, I think we should be enjoying the relative freedom of today (and trying to preserve it for the future); it seems too many are trying to spin "security" as something beneficial, when what they are really saying is "we're making things secure against you and taking away your freedom so we can control what you do; it's also effective at securing against attackers, which is all we're going to promote". If this line of thinking continues we may see devices in the future that are even more locked-down and user-hostile.

(FYI I've worked with embedded systems for quite a bit and also knew SD cards had firmware in them that could be modified, but never really investigated it - just put it in the back of my mind as one of those "I'm curious enough that if I had the time I'd have a go at it" things - along with several dozen others.)