Because they already run new code with the amount restriction in it? A new version will be released, then everybody has the fix.
You found a critical bug in the source code? No worries, it's already fixed in the trusted node code. RealSolid just didn't have time to release the actual source yet. And by the way, the trusted nodes are also running code that has all bugs and exploits fixed... even the ones that have not been found yet.
I fully trust RealSolid. Don't you?
Well, the 12 million being spendable isn't actually a bug since RS runs the control nodes and he wants to be able to spend it at some point. The bug was people finding out about them being spendable, and that is why we don't need source for the "fix". We just have to "believe".