Yepp, that's it. Finding the place obviously took more time than the actual patching.

My wild guess is they left it out deliberately, thinking "SSL wrapped" means SSL, not TLS.

Anyway, I tested it with secureimap.t-online.de:993, and even though I don't have an account there, it complained about wrong user/password with the patch (which was "can't connect" before).