My guess is prudent man principal applies - did they have a reasonable plan to remediate once the 0-day was known? How would peers in the industry have been aff

My guess is prudent man principal applies - did they have a reasonable plan to remediate once the 0-day was known? How would peers in the industry have been affected? If it’s truly a 0-day, and they followed reporting the breach, I don’t see it being likely. You could argue a single 0-day should not result in a breach (security is best as a layered defense), but that’s probably far less likely to find. https://en.wikipedia.org/wiki/Prudent_man_rule https://en.wikipedia.org/wiki/Prudent_man_rule