Did Cursor made claims to this effect and invited public to hack them?
Or are you equating someone saying they "take security seriously" to "it's an open season, please attack our systems."?