A few aspects of this article are strange or not well expressed.

Why does it matter if Cathedral follows some bug bounty rules? Black hats don't follow rules.

And IMO the citation about acting irresponsible when a company "relies on conventional business software" is taken out of context and is about AI safety, not a vulnerability in Slack.