> They "fixed" the issue, but did not bother re-running the PoC. It still worked. I pointed out the fix was incomplete, and was told "that issue was already fixed".

That reminds me of when cisco "fixed" a bug by blocking the curl user agent:

https://www.bleepingcomputer.com/news/security/cisco-botches...