The risk is that some unknown hacker discovered this vulnerability and abused it before the researchers discovered and reported it. It sounds like the company has confirmed that didn’t happen, but they aren’t 100% trustworthy in that regard, simply because they might have missed something.

The idea of it being numbered is that you are given your number when you vote to check against later, but nobody else is given that number so they can’t tie the vote to you.