with the acquired information, the researcher has a few options: - bulk acquire stolen credentials, bypass 2FA, bypass the security checks when sending money,

with the acquired information, the researcher has a few options: - bulk acquire stolen credentials, bypass 2FA, bypass the security checks when sending money, and accumulate wealth - sell above process to anyone that has an internet-connected device, the desire to accumulate wealth, and willingness to commit fraud (which I would guess is a non-trivial % of the world's population) - disclose the vulnerabilities to paypal through any available channels The fact that they went with the latter AND were punished for it doesn't shock you? Jesus.