Yes and no. This is a bug and a high severity bug once exploited. But as long as the main software product works "well enough" for a customer to pay for the dev

Yes and no. This is a bug and a high severity bug once exploited. But as long as the main software product works "well enough" for a customer to pay for the development and be happy with it, an agency doesn't care. The prioritization of security varies by industry That said, my point is moot since it's a bug in a security fix. From the other comments Nexmo is going through some growing pains as it transitions into the enterprise and their IT department is struggling with prioritization.