This attack shows us it's possible to change this link and play games, but it's impossible to say what other effects this would have outside of the easily testable scenario laid out in the article. Maybe this change of link invalidates data stored in a billing system, messes up a monthly report that goes to Microsoft's XBox division or causes an internal admin page to crash on load.

I'm not excusing EA but I have worked on plenty of complicated microservice systems and it's not always so straight forward to change the structure of data in one place.