slrnpull should be owned by "root" and merely group "news". Otherwise it is easily replaced by someone compromising the "news" account.
Fixed in the latest build - thanks for the report.