I'd imagine before someone reports a vulnerability, they're likely to research the company's history in dealing with reports. You don't want to openly reduce th

I'd imagine before someone reports a vulnerability, they're likely to research the company's history in dealing with reports. You don't want to openly reduce the incentives you give to people to report exploits instead of selling them. So PayPal deals with this exploit without it affecting their users, but their users now prone to be exploited in the future.