Is that a question? WD already has a knowledgebase article listing the differences between OS3 and OS5.
My Cloud OS 5: Feature Differences Between My Cloud OS 3 and My Cloud OS 5
OS5 is what it is. This is mostly a user-to-user support forum. WD Support rarely if ever provides any information or details on any “fixes” or feature enhancements to the My Cloud firmware.
The speculation by a few in these subforums has been that OS5 is a setup for WD’s EdgeRover (https://support-en.wd.com/app/products/product-detail/p/2293). One can dig through the OS5 subforum posts for all the issues users are having with OS5, from loss of features they had in OS3 to the indexing “feature” that cripples and or renders their devices (particularly the second generation single bay My Cloud) unusable and inaccessible for hours or days.
The unfortunate reality is that like pretty much all other NAS devices there are security vulnerability’s that are discovered for the My Cloud. Sometimes they are patched. Other times not. The WD My Cloud OS3 firmware has its share of security vulnerabilities over the years, some of which were eventually patched by WD. The workaround, while not ideal, has always been to disable remote access/cloud access, FTP access and any other methods of remote access to the My Cloud. This can include setting up rules in the local network router/firewall to block all remote network traffic to the device.
A number of My Cloud devices are End of Updates and are stuck on OS3. In some cases one can attempt (unofficially) to load alternate, non WD, firmware or operating systems to their devices with varying degree’s of success. The reality is that end of life and or end of firmware support on a device that leaves it open to security vulnerabilities is a fact of life. Its a common occurrence in the electronic/software world.
WD Product Software Support Status
Edit to add: And for those OS3 users they can possibly automate the running of the third party “patch” that is mentioned in the Krebs article by saving the “patch” as a script and having it run at each My Cloud boot via
/etc/rc2.d/S98user-start (if that user-start exists within one’s My Cloud firmware/root structure).