It's not hard to reach a living person who works at Apple. The next step should have been reproducing it for that person. It's not clear that the finders in this story did that - it seems they might have been trying to find out about bounty payments first.
If any tech support or Apple Genius were to have seen this bug reproduced, it should have immediately been easy to flag to the right person.