I agree it's a big deal, in that it's serious - it's a security vulnerability after all, yes. But I disagree about its significance for Apple in the face of the sheer number of security advisories that come out across iOS and macOS each year. When we broaden perspective away from just Apple, this becomes absolutely miniscule. There's a lot of navel gazing going on, but there's not a lot of reason to read anything particular out of this at all.
It's very silly, and I would also be embarrassed if I was involved in it, but those aren't good metrics for judging the realistic frequency of bugs like this, nor their severity. I've had vulnerabilities I've reported picked up by a bunch of news media before even though they weren't that serious. As it turns out, the media just latches on to security headlines, and everyone sort of forgets about it except us grumblers on Hacker News, because we Never Forget.
Someone from Google Project Zero has probably been inspired to start fuzzing the macOS at the UI level now, and that's a good thing - they should. But that's about all I'm taking away from this story.
Moreover:
> on an OS that’s only used as a personal computer, not as a server
This makes it less severe, not more so. I'd rather have a Heartbleed impacting nearly every server on the internet than a...whatever we're calling this, impacting every macOS computer in the world. I guess I can make a botnet...except I still have to be local to it in the majority of cases, or do specific targeting, or chain this with another piece of popular, compromised software, etc. It suddenly becomes a bit more complex than just someone pressing enter on a root prompt twice. Plus, if the vulnerability is laughably silly, it's usually easier to find than a chain of them that evidences a systemic misconfiguration in the entire OS.
In fact, I'd posit that the reason this story is getting so much attention is precisely because the vulnerability is so easy to understand, and because someone disclosed it on Twitter. Frankly, the whole situation is really quite funny in a black comedy sort of way. But while it's fun to write stories poking fun at large companies for their silly mistakes, it doesn't meaningfully reflect their security competency or the long term perception of their security competency.
Really I don't mean to trivialize it. It's not a good look, and definitely it's worthy of being patched. But I think it's worth looking at from a much broader perspective.