Anyone reading this article on the attack vector and this forum post could have discovered that Ursium is wrongly confident because the split function calls the reward function. Then it would be easy to execute the attack for a mediocre web3.js developer.