Yes, but again, proving there's an exploit is different to implementing it and actually stealing someone's banking details (which is the media definition of a s

Yes, but again, proving there's an exploit is different to implementing it and actually stealing someone's banking details (which is the media definition of a scary hack). And you say "even a security researcher"... surely they are the guys most likely to be able to perform the exploit, in real life?