Eh, it's a bit of both.

If a service has a duty to keep your data secure, then failing that is bad. So yeah, the website should be better and I am as cynical as you are about it.

But working around controls to access other peoples data can lead to prison time for a human. This wasn't a white hat operation. Data was exfiltrated however great or small.

Here we have another instance of "But the AI did it! No one is responsible!".

Which gets tiring. LLM's are a great tool but in every other instance of tool use, using tools comes with responsibilities for their outcomes.

Even if the outcome should be: thanks for letting us know, we'll fix it.