The code changes are only a threat if they are approved by the top 19 witnesses

I think it needs to be qualified what this means. Pull requests to the main codebase need to be approved by steem developers. This is different. What this means is that each of the witnesses would need to deploy this code to their witness servers. I haven't seen all the code, but I imagine there would be required an additional task beyond just deploying the code as well.