Sorry, but have to disagree. Seems like you're fighting your personal war thanks to shellshock. Imagine the opposite, vuln in busybox, practically all routers in the world exposed (and N900/non-CMdroids). Someone from bash proponents in CSSU comes in and states: "You see Estel, you're a dum...."
Bash was chosen for its features because this is full linux distro, not embedded system. We can afford running full blown (pun unintended) and featured linux distro with the latest and greatest (gplv3 even), try compiling/packaging some stuff on device and poor-featuredness of busybox tar will jump right at you. Yeah, go ahead and relink gtar and then...