There's a difference between shaming a company because they didn't give orphans free food, and failing to secure the data they opted into collect. We have a duty to treat people as ends, but no such duty applies to companies nor their paid mouthpieces (during their duties).

If the company didn't want the burden of security, then don't keep secured content. They opted in.