The application of it is not intended to clean the ocean. As you say, you're supposed to put it in the (washing machine, dishwasher, waste etc.) before it gets to the ocean.
At a glance, this looks cool - im in the middle of designing an internal Customer Data Platform/Single Customer View to serve as a single data source for various internal & external marketing tools. Looks like this might be worth looking at.
Does it have an API to access the user profile and group data ad-hoc?
Can you stream data in?
Can it trigger a destination sync when the underlying data changes?
Can it do profile merging (visitor -> known customer stitching)?
Even though it's not a security bug, I'd give the guy a small reward for contributing given that the community/support for this project is trying to grow.
They could have reduced a lot of the work (calculating the mean across 32 bookmakers and applying a constant for the margin) by just taking the price from a highly liquid exchange like betfair, which is pretty close to a 100% efficient de-marginated line.
Although it still wouldn't have prevented their accounts from being limited.