Tony, Gallery does have a e-mail list where they announce new versions and also security concerns.

Right, and that's exactly the sort of maintenance I don't want to have to worry about.

I realize it's feasible that there would be exploits that don't require comments enabled, but I think that if there ever is an exploit, it's much more likely to happen because of a field input like that. So I just feel safer not having it.