Perhaps the exploit was not as large or dangerous as the team says it is.

It's a monorepo and they're at over 1 million PRs. There's surely some juicy stuff there.