This seems like the kind of bug that can cause a lot of harm (if a malicious actor wants to track someone's location) but not so much profit (no generic mass-account-stealing).

And that's a situation that the US legal system isn't well set up for.