Here at the core dev sprint we had a discussion about whether adding ChaCha20 into 3.5 was the right call.  Strictly speaking, of course, it's neither a bug fix or a security fix, so that suggests it shouldn't be permitted.  However ultimately we concluded it was okay to leave it in.

One thing that bears pointing point out: the Windows binary installers and the Mac 64-bit installers are built against OpenSSL versions that don't have support for ChaCha20 anyway, so it's not going to change anything for those users.  Ned wasn't sure whether or not 32-bit Mac binary installers would or not--and it's such an irrelevant platform he couldn't be bothered to find out.