Who in their right mind is going whistle blow and risk their entire career over a security flaw that was detected internally, found to be unutilized, and was fixed in a timely fashion?
The fact that such a case even has reporting requirements at all seems nuts to me.
I am shocked to see the "let's make writing vulnerable code illegal" take be so popular on HN. If you have written any meaningful amount of code, you have written vulnerable code.
Every case I've seen in my career where this has happened has not been "negligence" but developers not realizing there's some obscure logging middleware or something.
An employee who left for another job or simply retired and who feels this was wrong. Plenty of lads in Meta earn enough to buy a house and have some investments that there is little leverage over them to ruin their careers.
The fact that such a case even has reporting requirements at all seems nuts to me.