It’s also a cop out as they were leaning on the assessments of the vulnerability as a medium risk information disclosure by many security analysts. That is accurate in many respects, but not in the context of a multi tenant environment or in places where different compliance standards are in play.

It’s particularly obnoxious when you read about the heroic efforts that were put in place to put AWS, Azure and GCP right. If it was no big deal, why go through that?