This is astonishing. The company behind the DAO knew that the bug in question affected withdrawals from the DAO rewards balance and wrote a blog post saying this isn't an issue because it's empty, but either didn't bother checking whether withdrawals of of people's original capital through the splitDAO mechanism (which is possible) had the same bug, or did and pretended it didn't exist and everyone's funds were fine.