So, no wrongdoing. But $35m in penalties.
How many people were "affected"? It seem that much of that penalty is refunding the defrauded customers. So, no criminal charges, pay back the affected customers, (any compensation to the customers for the crime committed against them?) and if there's anything left in the "penalty pot", that's the actual fine.
It sounds like it's barely a slap on the wrist. Corporate buys it's justice at a knock down price. Again.
Why are these sorts of cases even allowed to be settled out of court? It sounds pretty much like an open and shut case of fraud. The actions of their software were designed that way. This is not a mistake or a "rogue engineer".