Just to clarify my point: The bug was a screwup. We’ve all done screwups. My worst bug was an amateur hour royal screwup that resulted in DDOS. Nobody should be shamed for bugs, including serious ones that get to production.

Not fixing a serious, visible, known bug for six years is what’s shameful. There is nothing positive about neglect like that. It’s kind of admirable that they actually rewarded the guy but it shouldn’t have even got to that point.

Totally agree you should not shame for bugs. The shame is for ignoring this bug until one of your customers finally had enough and fixed it by patching the binary. If it was my company I would feel ashamed.