But the function people were exploiting needed to be public, I don't see how internal by default would have made any difference. The real issue here is that th

But the function people were exploiting needed to be public, I don't see how internal by default would have made any difference. The real issue here is that the class constructor called a function instead of containing all code within itself. It's a fundamental misunderstanding of how the EVM works and how Solidity compiles to it. I've read the code and it's hard to convey the level of incompetence that went into having a dynamic call from the Wallet constructor to the initWallet function; but it's very, very high.