The Co­Initialize­Security function demands an absolute security descriptor (devblogs.microsoft.com)

Imagine not making an API more flexible because new users of it would fail when interacting with old versions of the API.