How is that even possible? Beyond storing passwords unencrypted anywhere, why would you make a specific endpoint to return them.

It feels suspicious that someone could be capable of building this app (requires some level of knowledge) and creating a publicly exposed endpoint that is almost designed for malicious purposes.

Perhaps plausible deniability around selling data? If you outright sell data, that is illegal, but if your app "leaks" data maybe it is harder to prove malfeasance and instead say "negligence"? I am obviously not a lawyer and certainly don't know the laws of Israel. Does what I described ever happen?

I'm not sure how you'd monitize publicly leaked data. If they accepted money for access to the data, then that's selling data. I don't think that happened here though.

Maybe something that was quickly coded up in the beginning to allow testing by team members and later forgotten. Happens all the time, that’s why you do code review and have at least two people approve changes to master.

Plausibly a dev/debug hack that should never have made it into production.

Either way, they wrote the functionality and it is shoddy work.

It doesnt surprise me. One dev creates the endpoint for testing, leaves the company and the next dev does some refactoring and it makes its way to production. Many projects are done under a lot of time pressure. Also, often devs face worse consequences for a late project than for a catastrophic error.

Why would anyone? The riskiest place I would keep passwords is in an encrypted archive. Barring unknown side channel attacks, my brain is less secure than that.