I'm inclined to believe it. As someone who studies this side of the Internet quite often and has seen equally trivial exploits stay active for weeks or months without being patched, I have no trouble believing this claim. I'm sure there are messages in Telegram channels from weeks or months ago that corroborate this.

When your job is on the line, you use AI like your boss tells you to. Implement the spec and move on. No time to think about security, if you delay this feature it's your ass.