Sure, but that can easily be turned back around on you: There's no proof there that they are now at more risk. > I've looked at the code and I can see already

Sure, but that can easily be turned back around on you: There's no proof there that they are now at more risk. > I've looked at the code and I can see already some potential supply channel attacks as they are not hash protecting their incoming libraries. And if you, or anyone else who sees that sends them a notification about a potential vulnerability and they investigate it they're probably better off than they were before.