It is either malicious incompetence or a red flag. No other explanation for me is satisfactory.

Check out /r/NotMyJob/. You can lose faith in employees, and humanity in general, one video at a time. All it takes is few people who DGAF and security issues won't ever be detected, to say nothing about addressing them.