Again, I think a hardcoded whitelist is tricky to define without requiring code changes to core for every new STI plugin. But I'll refactor the method, sure.