Polymorphic relations have never been handled properly, there were purpose designed originally for the upload plugin and then later for dynamic zones.
It should still need to go through an RFC to approve implementation strat before a PR. RFCs aren’t just exclusive to feature requests. Its any topic that spans multiple points of interaction. simply fixing the content sanitizer is not enough to bring support for polymorphic relations.
There is the CTB and CTM to think about, referencing and storing in the schema files, database layer support, plugins, ect.