They do. They just removed 77,000 signatures for fraud: http://www.independent.co.uk/news/uk/home-news/eu-referendum... (Which probably wasn't even hard - if you look at the claimed 4chan script, it uses the same postcode for every vote, which happens to be the postcode of the Houses Of Parliament.) The total number of signatures is over 3 million. Additionally, this article is from a right-wing tabloid site of questionable honesty, and is based on taking 4chan comments and random tweets at face value and then accusing the "Remainstream press" of failing to perform "basic journalistic research" for not doing so.

Never overestimate computer security, it's almost always worse than "surely it can't be that bad"

Well I've met people who've worked on the app, and I doubt that both these folks and a GDS team would miss the major hostile use case of the app.

Wouldn't surprise me if they didn't.

That said I'd say hold for now until confirmed: 4C can have equally much fun trolling us by pretending they trolled them.