Professional Engineer (PE) certification for cyber security professionals would help.

Without personal and professional consequences, the default 1 year of credit monitoring for weak security is just the cost of doing business.

How would that help?

By all accounts this app has no security professionals involved with it.

Its not like there was some incompetent cyber security expert saying its ok to skip ACLs in firebase.