The only question I have, in this particular case is: what about the victims of the original app? Are they possibly the subject of re-victimization if the app o

The only question I have, in this particular case is: what about the victims of the original app? Are they possibly the subject of re-victimization if the app on their device is compromised further by 3rd parties? Though I completely agree with HackerOne's moral stance here, does this particular scenario complicate things? EDIT: I do see they took this into consideration in their writeup... still curious.