The bug

The player is blocked from being able to directly attack the mob on which it rides. This, however, does not appear to be true in general, even though I'd expect it would.

How to reproduce

/summon villager ~ ~ ~ {Passengers:[{id:zombie}]}

Expected results

They may not get along, but the villager should not get attacked by the zombie.

Actual results

The villager is eventually murdered by the zombie in cold blood.