Yeah they should poorly set up a sandbox and ask it to fix all the vulnerable servers with the remote RCE and prepare to be surprised when it escapes the sandbox.