[mvkel]

The DPC would disagree. All you need to show is that you took "reasonable steps to protect users," which is trivial to do, and not even a single fine will be levied.

[dbbk]

What reasonable step was made when the exploit was left open for months?