ArtChain had that bug, it was trivially discoverable with automated scanners, someone told them about it, and they did _worse_ than ignoring the report -- so yes, I agree, your example is really more of a counterexample :-D