Surely that's completely unreasonable. Who can claim that any piece of software is without bugs/security holes?
The problem is absolutely owned by Atlassian, but they actually did do something to fix it.
I don't believe anyone (apart from maybe Daniel J Bernstein) can claim any piece of software is bug/hole free, and neither does anyone need to!