A maintainer came forward and volunteered. That doesn't take focus away from other people who will be uninvolved.

Although I could see a security argument. Wasn't there a qemu bug that involved exploiting a virtual floppy drive?

Yep, although I'm not sure if the virtual floppy disk is the same thing as is being discussed here.

It even had a catchy name "VENOM", https://venom.crowdstrike.com/

It is not the same thing, no, but it highlights that having privileged code that is not frequently exercised or thought to be running can lead to bad times. Most users who were vulnerable to that one were likely not frequently thinking of the floppy device.

It's a floppy driver. I don't think much is going to change, besides making sure it still works