I'm not in this thread to discuss
technical merits of the existing implementation. It may be 100%
crappy code. All of what you say above may be true, but
that being true about a widely-used feature doesn't
automatically mean that eliminating the feature increases
security.
I'm not even in this thread to object to
doing extra work to break users' systems, because you may be
right that most users of tcp_wrappers that use it for the DNS
functionality shouldn't, and it might be irresponsible for us to
support such configurations.
I'm participating in this discussion because, as a general rule, I
assume most administrators configuring security, and most users in
general, aren't idiots. So, the fairly large number of
assumed non-idiots using this functionality suggests, as a first
approximation to truth, that it is useful, and it's the few of us
that discuss removal of the feature that are wrong about the
consequences of our actions.