I know there are bad business reasons, but how can someone classify a VPN leak as "not a security issue" and keep their pride?
They're paid not to.
At some point digital security turns into physical security, and there are national security interests that have fine-tuned their detection logic on these kinds of "buggy" behavior.
If you patch it, you'd need to find another way to de-anonymize those users.
How can someone consider unwanted disclosure of personal information a security issue, and work at Google?
Corporations have no pride. They are soulless, psychopathic accountability sinks.
What planet are you from?
That assumes there is pride they have to bother to keep.