Spoiler: they had absolutely no concern about user security and used public buckets and an API with no access controls.

In 2025, this behavior should be criminal. It is wilfully negligent.