Commenting on your second thought: I hoped that people behind DAO (and Ethereum?) will stick to the terms they themselves proposed but it seems they will push hard for forking the chain (see: Ethereum blog).
The terms of The DAO Creation are set forth in the smart contract code existing on the Ethereum blockchain at 0xbb9bc244d798123fde783fcc1c72d3bb8c189413. Nothing in this explanation of terms or in any other document or communication may modify or add any additional obligations or guarantees beyond those set forth in The DAO’s code.
Doesn't it state that, by definition, that DAO contract is bug-free, so it cannot be exploited? This is exactly what separates DAO case from flash-0-day-rootkit case. login_action = Write('PASS') >> \
Read('pass') >> \
Guard(lambda v: v['pass'] == 'mysecret') >> \
Write('WELCOME')
register(socket, login_action,
Of course you can develop this idea futher: cat = Read('line') >> Write(lambda v: v['line'])
cat.append_action(cat)
register(socket, cat,>