Was this attack genuinely dangerous? Or was it just a social experiment?
The fact that they released the updated font to the public means everyone using that font became vulnerable if they had a similar lack of bounds checking inside the pdf reader (which is incredibly likely).