While I'm glad they didn't give one of those insulting 10k payouts, I'm actually surprised this one wasn't higher.

This isn't a complete remote takeover but accessing a live feed of an unsuspecting person just by them opening a URL seems like a really big deal for a company that is all about privacy.