The blog post talks as if a future stepping of RP2350 is all but guaranteed, they will likely fix the pull-down bug too. That matters a lot more to hobbyists than hacks that are very involved (and need phyiscal / voltage rail access).
As a security nerd I like the idea of a cheap MCU with hardware security, but as an electronics nerd I'm not keen on having users who just want cheap MCU's (the majority of Pico users) to have to subsidize a potentially expensive security chip. Last time I looked, smart card chips cost quite a bit more than the RP2350 does. So we're quite possibly talking about adding considerably more than a few pennies a chip, which is already a lot for this type of product. Hmm.
Four winners are each awarded the full $20K prize.
Yep, multiple independent total compromises. It may well take quite a few more iterations to fix everything. And of course they'll never know if they've really fixed everything. Better to just see this as a general purpose MCU with some basic security features, but not hardened the way some smart card chips are.