> Once an ICO starts, the contract cannot be changed and is open to everyone
Many teams have upgraded their contract without an issue. The market has stopped reacting to it completely. They just release a new contract and airdrop it to all existing holders. Notify the exchanges, and it is business as usual.
This is more of a FYI. I'm not really curious about what this particular research group is doing, or why this article uses "vulnerability" without the distinction of how benign these things are.