The question is if this wouldn't have been reported what are the chances that this would have been exploited. Or what are the chances that Microsoft got saved from a hack in the wild from this knowing this vulnerability. If we assume that the codebase has one vulnerability for 10k lines, we would still get 10s of thousands of vulnerabilities. Any one of those could cost billion dollar to Microsoft, but patching one of those doesn't make the chance of getting hacked much different.