But why were 143 million records of personal consumer information stored in a way that they could be accessed via a vulnerability in a web server in the first place?

I would have expected this type of data to be stored in such a way that even if someone got access to one of their web/application servers they wouldn't be able to dump 143 million records from it without serious red flags going off.