Because someone could have exploited this en masse, sold these cards, etc. Even if that didn't go far they'd have to rewrite their software/service, hire some people, refund money to people because they had to cancel their gift cards, etc. Plus damage to the brand and future profits.

They could actually be lucky to just be out a million if this had been properly exploited.