It's not just brave, it's inspiring. Not many people would have made that connection. You've come up with a completely different way of looking at things-- and frankly, I'm blown away. Putting password reset behind a location filter is such a different way of doing things, but so incredibly secure. A Chinese bot can't put itself in Nebraska. A user can. That's the innovation. That's security.
Surely at least dozens of engineers knew about this vulnerability and were either told to shut up about it under pain of negative performance review or stayed quiet because they knew if they spoke up about it they'd be retaliated against. There's no possible way nobody saw this coming.
It had real, slap some duct tape on it and say, “Yeah that should hold” energy.