That’s typically how you show that something is vulnerable before it becomes a real problem.

I mean, criticize the headline if you want, but this is pretty standard reporting for this kind of thing. Recent stories on vulnerabilities in networked car systems were handled using the same approach. (It finally got attention, too, even though security researchers had been pointing out the same issues for years.)