It doesn't seem like they took this security incident very seriously. It's a pretty serious bug that was reported by two different users within a few hours. It could have been abused by others, but it doesn't look like it occurred to them to roll back recent changes whilst they investigated the problem.