I suspect if they had been able to document the steps taken that got them there and reported it as a vulnerability they might have not only got it fixed pretty

I suspect if they had been able to document the steps taken that got them there and reported it as a vulnerability they might have not only got it fixed pretty much immediately but also possibly a bounty.