I have talked back to my pkg-boinc mates and, well, feelings are mixed.
The remaining source to this TV report and some prominent discussions about it I found at
http://www.rechenkraft.net/phpBB/viewtopic.php?f=12&t=12717&start=12
And while I think that no real damage is done (and the package could hence just remain as it is),
I also think that it might be unfortunate for Debian to ship any code with known vulnerabilities.
Hence my initial request to remove those binaries only.
If you decide to remove the package as a whole, then do so. It however be nice to see
us allowed into backports.debian.org as soon as possible (with the version we want to see
redistributed rather than that old one in the first place ...).
Many greetings
Steffen