As the article notes, a good portion of the information is already public like you've said. However, as I see it, there are two types of "exposure" at play here. I took the "exposure" in the headline to mean "a publicly accessible database is serving up information that the owner might not have intended to reveal," rather than "sensitive personal/private information has become public." In my opinion, the "exposure" being described does not have to be the latter type to be unsettling or worthy of mention.