They do say they couldt find the vulnerability right away, that doesn't mean or doesn't exist though. If they don't investigate even the flimsiest of claims, it could cost quite a bit in cleanup.