The change was done to allow the vector to be created by the allocator instead of being returned as stack-allocated. The failure would only reproduce when an invalid block was received, and happened to attempt witness deserialization while the stream was invalid. This is pretty common, and there is no early termination of deserialization due to invalidity, as this would introduce a lot of additional conditions.