IME if you are a part of an org/feature-specific security team at a team at large company you will be made aware of potential security flaws before they are fixed and merged in prod... so if some employee at apple learned "hey, auth tokens are being leaked in the usage data" they could hack basically anybody if they wanted to before the fix was merged and deployed to the public