The boilerplate FAQ text is frequently wrong or incomplete. You can go through the catalog and look through some of them and see how many have multiple revisions. I think, if you want to know definitively, you have to patch diff it

Where does it say that you can't be phished with a bmp file?