The reason for the badness is that the D-Bus service file has been moved from /etc/dbus-1 to /usr/share/dbus-1. Generally it would be a formal change to the whitelisting only. The last review has been quite a while ago, though, so we should at least look a bit closer at the current D-Bus implementation if anything problematic is around these days.