i was thinking that too as they fixed a vulnerability by creating an empty folder and then users deleted the empty folder, which undid the vulnerability fix lol.