I'm hoping that their security folks are now going through and writing extensive automated tests for all of this code, and anything similar, and turning on lots of automated static analysis to go along with it.

I fear that it may end up as, "we already found the bug, we don't need tests now". But that's probably pessimistic of me.