So every private key actually has TWO associated addresses? (ie uncompressed and compressed) So every private key actually has TWO associated addresses? (ie uncompressed and compressed)

Isn't this a MAJOR flaw if uncompressed keys are still used in applications?
Nope. It's not. If you really think it's a flaw, explain some way you think it can do harm.