You are approaching from the wrong angle. How much was the exploit "worth" to the company?

Some people want to watch the burn. An attacker could make it known anonymously and LastPass will never recover from that onslaught.