Our patch was wrong, it caused guarded_getattr to always allow
attributes of not protected instances of old-style classes. While this
look like a severe security hole, I don't we are using any sensitive non
protected instances

Because cStringIO.StringIO("initial value") makes a read-only StringIO
using another type, this was not supported.