It has been 3 years since I reported a problem in one of their services and they still haven't found anyone who seems to even be able to understand the problem.
That’s basically the logic at play here, covered in an Orwellian veneer of “responsibility”.
Unsuspecting users.
When you don’t give companies a chance to fix a vulnerability that could have serious consequences for users, you’re effectively putting the users in harm’s way by disclosing it to the public. Bad actors will take advantage of that information very quickly. Nothing good comes out of that.
Whether you like the company or not, remember that the users have no idea they’re at risk.
Basically something is stateful that shouldn't be, probably because it's built on Lambda.