Perhaps plausible deniability around selling data? If you outright sell data, that is illegal, but if your app "leaks" data maybe it is harder to prove malfeasance and instead say "negligence"? I am obviously not a lawyer and certainly don't know the laws of Israel. Does what I described ever happen?

I'm not sure how you'd monitize publicly leaked data. If they accepted money for access to the data, then that's selling data. I don't think that happened here though.

Maybe something that was quickly coded up in the beginning to allow testing by team members and later forgotten. Happens all the time, that’s why you do code review and have at least two people approve changes to master.

Plausibly a dev/debug hack that should never have made it into production.

Either way, they wrote the functionality and it is shoddy work.

It doesnt surprise me. One dev creates the endpoint for testing, leaves the company and the next dev does some refactoring and it makes its way to production. Many projects are done under a lot of time pressure. Also, often devs face worse consequences for a late project than for a catastrophic error.