Before getting religiously high and mighty it might be instructive to run a security scan on the whole of the Internet and see how many SQL injection vulnerabilities exist on the websites of major US companies and small time startups.

The fact that MongoDB has in itself a vulnerability to unchecked input is not great. But consider that if you are dealing with client side browser or server side software, the entire stack is rife with security vulnerabilities because the components themselves right down to TCP/IP are inherently insecure.

Be careful out there, and write nicer bug reports. Use the process. If you were on the other end of that bug report, you would feel differently.