Well, this thing happens frequently when every _websites_ want to throw their "apps" to the customers. But their actual "apps" are out-sourced by cheap MSP somewhere. That explains the lack of security effort.