Comment by SillyUsername

So they knowingly deployed a configuration with an overflow risk, much like writing code with a buffer overflow exploit.

They assumed that it wasn't like an overflow exploit, despite the fact that's exactly what they'd set up to happen, on the grounds of thinking the equivalent of, "oh this probably uses smart pointers, we'll be fine".

That's how I read it anyway.