Yeah, I think Booking.com need to address it on their end too. Especially if these exploits become increasingly sophisticated. So far they haven't responded to my contact.