They have responded on twitter to someone linking to this post
@danielhepper This was reported back in May and was since resolved. If you have any concerns please contact us at support@nexmo.com.[1]
Maybe they fixed another security issue as they never inquired about the security hole you found. Which you suggest is still present.