By the way, Ubuntu applies security patches to embedded code copies inside vino: https://launchpad.net/ubuntu/+source/vino/3.22.0-7ubuntu1
I'm personally not working on applying those changes to Debian since I have a long todo list and I'm trying to remove vino, not fix it. Sorry. Thank you, Jeremy Bícha