There are tens of thousands of extremely skilled hackers selling exploits on the order of $10K to $100K. I'm fairly certain someone has been exploiting it. Not everyone is a good guy in the world.
Mowing 50% of lawns in the US means nothing if you still net a loss. When do people stop basing valuations based on the hope Amazon will make a profit? Hint
No he did not do the wrong thing. Reporting them is completely wrong. When we report the people who protect us, well this sounds like a plot to a movie. PS: in movies usually a lot of people suffer before the resolution