On: Decades-old GnuPG bug allowed hackers to spoof just about anyone’s signature

I'm not certain, but doesn't GPGME do something a bit more sophisticated than that?

Nope, GPGME spawns the gpg binary too.

The major advantage of GPGME is that it's written by the same folks as GnuPG itself, and hopefully they know how to use the binary correctly.

Unfortunately not, as far as a quick read of engine-gpg.c seems to suggest.