Corrent me if I'm wrong, I'm not a security researcher, but 20 hours, a week of work, 2283$ spent and over 2 trillion tokens, is not very 10x-ing as we were promised. Especially if you take into account that the guy is at least half capable for this take.
I dunno
Of course security by obscurity by itself is by no mean sufficient.
Open does not mean vulnerable, open simply means it's a more obvious cat-and-mouse game.