It seems that VRC PoS vulnerabilities are not fixed yet so attacks like this are possible.
Somebody is about to make you feel really dumb. Will leave it up to that somebody to do that.
Why does it have to be about making someone feel dumb? Just offer the simple explanation: The security issue is with MintPal, and MintPal alone.