Bitcoin Core – Consensus Questions

With recent developments in spammers and those trying to filter them out. There are a few things I don’t understand. They mention an unfixed bug (CVE-2023-50428). From what I understand, this “bug” is that the Bitcoin Core developers did not implement a filter for jpegs on the policy side after the taproot merge, and if they had implemented it like Bitcoin Knots, they would still be able to get into the block. That there is. Because with the help of miners it is still within the agreement. That’s the first one. Another one is about op_cat and other contract proposals. For example, bip 420 is for the reintroduction of op_cat. Is it prohibited in terms of agreement, as Satoshi removed it, or is it prohibited in terms of policy? If removed from consensus, how will they be backward compatible if merged?

thank you