The vulnerability stems from truthiness checks on the 'only' parameter. The patched changes explicitly check for None instead of falsy values. The three modified functions all handled the 'only' parameter validation and field filtering logic. In vulnerable versions, passing an empty list to 'only' would bypass field filtering in _normalize_nested_options and _update_fields due to Python's falsy evaluation of empty lists, while init's default empty tuple initialization exacerbated this behavior. These functions would appear in stack traces when processing serialization requests with empty 'only' parameters.