In the space I work in, not specifying -i is the security risk. Everything is explicit. Also, not being able to change the iterations is another security risk. When on high says I have to do X seconds of iterations, but I want to increase my cpu power and use the same disks, what do I do?

Here is the test that fails with this patch. You can't change the password once it is set: