There must be something I'm not understanding. According to the timeline, this was around a year and a half from reporting to fix? I find it hard to imagine PayPal would let such a critical bug go unfixed in their services for so long - it's a higher risk to them than to anyone.

Am I misunderstanding the impact?