So true. Also becomes apparent from this sentence in the Hackerone report:

"This report seems entirely correct and it hurts in my soul."

and the blog:

"[...] shipping a heap overflow in code installed in over twenty billion instances is not an experience I would recommend."

Harsh to have to bear that responsibility for so little reward.