People noticing stuff is free work but it’s still different than getting PRs and actual solutions like a real OSS project. And that’s fine, people are doing it because they care or like the attention or outrage and all the other personal/social motivations.
"No doubt, many embarrassing issues will be discovered, but we will fix them fast!"