No security.
Great work, Apple!
That's a bit harsh; the bug comes from one erroneous line and it's easy to see how it might be overlooked.
This kind of bug is typical of a merge error (i.e. when multiple people are editing a file and merging their changes in when finished).
I'm a little interested how they know that it's goto and not some thing else does goto actually have a one-to-one mapping with something in x86? (I guess it would be jump? But there's plenty of other things that would use jump too, I would think? Function calls would have jump-and-link, while and for would have some kind of conditional jumps is goto really the only thing that translates directly to jump? I'm surprised Apple doesn't have a static analyzer that automatically rejects code using a goto )
They know it's a goto because the source code is available.
You're right that gotos are not a good idea in commercial software. I learned not to use them from coding standards in places I worked, and I also always curly-bracket my if/else blocks. This is exactly the reason why I now do both of those things.