I still don't fully understand — if a low-bit privkey public key is exposed, how could someone potentially derive the private key from it? Could someone please explain how that's possible?
Brute-forcing using the public key is much cheaper than brute-forcing using an address only.
if he didn't use it, he could go back and compile an .exe with o.random.

This is not how development works. You can't just "compile a binary" after sticking "o.random" somewhere and expecting it to work.
My friend, I didn't mention any binary. I said that he didn't provide the source code and therefore I don't know what he used to compile VBCr.exe in the end. Since I don't want to get his source code at all, I asked if he could recompile the code he has using o.random if that's not the type of random that the executable uses