It’s always reasonable to assume that black-hats (and… what do you call government hackers — black-suits, helicopter-hats, ???) know everything that white-hats know, and that they either have or are already in the process of selling that exploit to less skilled criminals.

It’s not like being good morally correlates with being good at security.

And how many people and companies are now empowered to fix this issue for themselves, immediately.