They say that less than 1% of all of their users logged in during the vulnerable time frame. I suspect those are weasel words to downgrade the apparent severity

They say that less than 1% of all of their users logged in during the vulnerable time frame. I suspect those are weasel words to downgrade the apparent severity of the problem. A more useful metric would be # user logins during vulnerable timeframe / # user logins per day.