We generally only fix API discrepancies when there are real-world applications affected by them. While you mention malware (Raspberry Robin) exploiting this difference, malware detection is not a use case we aim to support.
Is that a general rule? Surely there are cases in which emulating the exact Windows behavior is so complicated that it's not worth the effort if there are not applications depending on that, but when emulating the Windows behavior is not particularly difficult it doesn't make sense to make Wine incorrect just because you don't have a real application. I've contributed plenty of changes that I had devised from tests, even without an application depending on them.