MetaMask Knows It Has a Critical Privacy Vulnerability, But Hasn’t Fixed It