What kind of issues would this problem cause?
Since the arrays were not resized before trying to assign new values, if you were trying to deserialize a BL with multiple hosts or topologyPaths, you would get an array index out of bounds exception, which is a runtime exception and wouldn't have been caught. Since this happened, there must be no code that's trying to do. The deserialization is still broken and should be fixed though.
Is only trunk affected?
I checked back to the 18.3 code and this problem is there. It would probably be a good idea to do a patch for that version as well.