To be fair, this is a bug that could be the end of lemmy.

Then the reporter should have acted like it was, indeed, that important. Like, putting money or a PR into it.

Just "someone, sometime, somewhere, might sue" does not suffice to fix things. Just like with physical products in the real world, if someone, somewhere, sometime, might sue, then you designate money, time and staff into your project to pre-corect the things to minimize the chance of that happening, or to buy whatever auditing / maintenance needed to check for issues.

And, correctly enough, the devs are not saying "we won't fix this". They are saying, "fix this requires people to pour $X time and $y money into it. Care to chime in?"

Unfortunately, the world of free software users is full of "couch coaches".