I'm suprised they allow larger security holes in their products.

Technically, that isn't exactly a security hole. empegbot simply (ab)uses the normal webinterface every one of us uses to post messages and/or replies.
It could be made a little more difficult to actually exploit that interface, but the only way to close that "hole" is to completely disallow posts to the BBS.

cu,
sven