Someone ran an LLM through the piefed codebase to identify possible exploits and found a couple. And then, rather than holding off public disclosure of the exploits to give the devs and admins time to fix the issue, they announced the full details of the exploit in public.

It appears to have been a deliberate attempt to discredit Piefed and the lead Piefed dev, without any consideration of the impact it has on anyone else.