I see the risk, but in any event the version number can also be detected from the CSS and Javascript references. And for the same price as retrieving VERSION.txt, the hacker could just perform whatever request exposes the vulnerability, and see if it works. Luckily, none found so far... :)