So every private key actually has TWO associated addresses? (ie uncompressed and compressed)
Isn't this a MAJOR flaw if uncompressed keys are still used in applications?
Nope. It's not. If you really think it's a flaw, explain some way you think it can do harm.