This seems unnecessarily harsh. As you said, XSS is one of the most common vulnerabilities out there - in other words it's a very easy and common mistake to make. I wish we lived in a world where writing an XSS vulnerability was inexcusable incompetence, but the actual world we live in is one where even the best will slip up sometimes and we have to depend on audits, patching and defense in depth. (Which is exactly what happened here; a security researcher audited it, found the problem, and it was promptly patched.)