Those security holes seem damning for a project that was assuring everyone it was ready for prime time. Flatly unacceptable for something that they're actively lobbying folks to get on board with.

Maybe less time running tokens to develop the engines and more time running security passes before running to tell the world.