What makes you so sure fixes are trivial? Do you know what their code looks like? How big their team is? What resources they have available to devote to this? W

What makes you so sure fixes are trivial? Do you know what their code looks like? How big their team is? What resources they have available to devote to this? What their runway looks like? What pressures they're under from investors? In a legacy codebase, even the smallest change can introduce all sorts of problems; and a small change to output or business logic can require disproportionately large changes to code. They may simply have determined that finishing the feature changes they think they need for their business to survive is more important than protecting against exploits that they consider either unlikely or low-value. And how acceptable this is may depend in large part on what the service in question is and how broadly it's used. The lack of concern you describe would be totally unacceptable from a bank or even Twitter, but perhaps excusable (at this stage) from an early stage company trying to build the next Twitter.