Ah right yea I see what you mean.
However those rules are for cases where users who are on their own accounts engaging in shitty trades and don't take precautions and end up getting scammed. In these situations it's that user who is at fault so we won't take responsibility to restore them.
With what's happened here it's not the account owners that logged on and sold their stuff away and now want it back. For all intents and purposes they were accessed without authorisation/permission and the items and stuff sold fraudulently. If it's found that the users' accounts were accessed because they gave out passwords (for example for illustrative purposes) or something like that where
they're clearly at fault then we'd probably be more hesitant to help them out with restoring stuff.
If this issue came about because somehow
we messed up on our end and should have taken more precautions etc then that means this incident is on us and we'll most likely fix them back up.
It's mostly about being fair and having the party at fault taking responsibility. Hopefully that makes sense? We don't have these sorts of rules for exploit handling written out explicitly because it hardly ever happens (ideally it should never happen) so there's no need for a record of it. :s We just work from what our general policy is (in this case: if you're at fault it's your responsibility. That idea is quite prevalent in those links in your post) and apply it as best we can in a way that's fair and makes sense. If you have any more questions I'm happy to answer but keep in mind that at this point this is still all just conjecture and speculation. We're still gathering info and so we'll get to this part of it when that time comes.