However, as Peter Lambert points out, even as trivial a fix as "allow user to select change address" would go a very long way to resolve the problem. You could have a clicked-by-default checkbox saying 'generate new address' with an optional field where user can supply an arbitrary address.

The automatically-generated-change-address-for-all-sent-tx model currently in place is very weak, weak to the degree of perhaps being deliberately so. It allows some presumptions to be made by an attacker that should never be allowed.

The problem now is that during the course of normal use, wallet backups become stale as new addresses are generated for change.

How about -- the wallet generates a (user) specified number of addresses, and uses ONLY those as change addresses and receiving addresses. If the addresses are all used, it should give a message to the user (perhaps have an option of whether to give you this message or just ignore it?). When the user wants, they can generate another batch of addresses. Thus the user will know when they need to make a new backup, since they are the one who decides when to add new addresses to the wallet.