I'm confused about how the security researches discovered this without breaking the law.
Paypal didn't contract them to do this research, so this means they just started fuzzing paypal urls till something crashed.