This is a company, one of three, which contains the credit data of hundreds of millions people, and a central figure in approving all sorts of financial transactions. Not only do they hold highly valuable data, they also have plenty of resources to draw upon to build an exceptional level of security. I think they very well should be held to a much higher standard then a random company using the Spring framework.