Problem/Motivation
Follow-up from: https://www.drupal.org/node/2364189#comment-9286001
I think #4 is correct, but if you search for $attributes[0] in *Pass*.php files, you'll find that HEAD currently has 6 incorrect implementations. And the only correct (i.e., #2.2) implementation is RegisterAccessChecksPass. Given that, I think it's okay for this to go in with either the incorrect implementation (#1), or with the fix proposed in #2.2. Either way, we'll need a separate issue to fix all the other ones, so if this issue adds one more, no big deal.
Proposed resolution
Implement the foreach loop over all $tagAttributes and not just the first one ...