This is not about that. This is about a security researcher that wasn't paid by Microsoft's bug bounty program when they found a security bug.
Bug bounty programs exist to prevent this exact scenario. To give people a reward for privately disclosing the vulnerability with the devs instead of publicly/to a bad actor.
Yeah. That's a huge issue rust has. However, it can't be solved with Rc.
You either do it in safe rust, by "cheating" the borrow checker and storing a size offset of the buffer instead of a reference. Or just use unsafe rust and store a raw pointer alongside the buffer.