A good point. My gut tells me these people haven't truly gotten it yet. It doesn't take much to go, "hmm, i wonder if any other part of my application might be vulnerable" and these people certainly haven't done that.