The problem is they did not see it as a vulnerability, they touted it as a feature, and even made a blog post outlining how you could exploit it. That was the most WTF event in following this story.