> How do you propose he would have been able to establish that this was indeed a vulnerability?

I could comment extensively on the issue, as it is not as cut and dry as you imply. Instead, I'm going to link to the HM discussion from 2017 , as I think it is insightful and covers nuances.

https://news.ycombinator.com/item?id=14835515