Verifier bugs matter for the kernel, which wants eBPF to be secure even for unprivileged accounts.

Verifier bugs don't matter that much, for most Linux users, right now, because unprivileged accounts can't use eBPF.

Put it this way: verifier bugs matter, but people probably don't do unscheduled fleetwide updates to fix them.