AFAICT one fundamental issue is that they don't seem to have hired actually security engineers or experts to do any actual security.