While the reaction of the company is moronic, there is still an idiot developer somewhere who is taking inputs from the client without checking appropriate access. This is web development 101. But in a world where anyone who can write two lines of php can call himself a web developer, it's pretty much the norm.