Didn't Uber just hire Chris Valasek and Charlie Miller (famous for the Jeep hack) a few months ago? Based on that I would have expected them to be at least half-serious about security. Or was that just for PR?