A bunch of folks tried to say the challenge was dubious at best and that the vulnerability was a legitimate concern, and were told by commenters here that they were fearmongering or shills.

Evidence has shown they were pretty spot on about the first part (the test originally served static html, the php code wasn’t actually as vanilla as described, and the bitcoin key wasn’t actually there).

I’d have hoped this kind of clear vindication on the first point might have caused folks to revisit their stance on whether to trust the expert stance on the second. But maybe I’ve been overly optimistic.