We've discovered a new category of potential bugs in shells. Yes, you're gonna see a couple of them. If you're going to think they're one and the same bug, chances are you have more serious security problems than bash.
Arguably, the bug is that function imports are a thing. The idea that you can have code automagically imported from data, especially data as unpredictable as the environment, is just
wrong, and I'm not aware of anybody ever actually making use of it. The correct fix would be to remove that functionality entirely; yes, it's an API change, but it's such a broken API that this is one of the very rare cases where that would be appropriate.