Absolutely disgusting, AT&T.
That being said, this guy is obviously not a saint. I don't want to sound like I'm defending his affiliation with GNAA or the fact that he went to Gawker with it.
If it had been someone who gives to community, is polite, and respectful, and instead had gone to the NYT or another publication, they still could lose 3+ years of their life. To a mistake.
Imagine, though, what the costs of getting a startup off the ground would be like if we did face civil liability for bugs and security flaws.