I know that? I’m just saying that MS categorised it as such. It would be strange to include the part about MS’s responses if MS also found that the vulnerability was not what the researchers claimed it was.

MS said they fixed it and categorised it as a “moderate severity vulnerability” so presumably they did in fact gain root access to the container

Aside from the fact that it was stored in a public database, there’s no need to store photos of the IDs at all. The account can just be marked as verified and move on.

Also I doubt that measure would keep a man out if he really wanted to join…