Why would people buy it on disk when it was released onto Disney+? It has other metrics of success - it was one of the most streamed programs in March 2022.
Are you saying that you think all these girls, at 50-60 schools across the entire country, who are displaying these symptoms, all at the same time, are suffering from... hysteria?
Bug bounty people (myself included, though mine's quite aged) have written scrapers on all the main popular CI/CD platforms, to automagically scrape tokens from logs & submit bug reports to get paid. Unsurprising if malicious actors have done the same.
That's not what VRchat's blog post say at all, though.
"Every month, thousands of users have their accounts stolen, often due to running a modified client that is silently logging their keystrokes as well as other information. These users – often without even realizing it! – run the risk of losing their account, or having their computers become part of a larger botnet."
People running a backdoor client and getting their passwords stolen? That doesn't sound... wrong?