Nobody intentionally includes security vulnerabilities in a product. This is something that Doordash knows they are doing and have decided to do, not something they are doing accidentally.
Even taking a negligent security posture is not the same as intentionally including a flaw.
Even if the exploited party itself it shady as hell. Say they were a credit card scammer, someone found a way of conning them for money, does that for a while to make some $$$, and then proudly writes a blog article exposing them.
Maybe I'm missing something though. That's looking at it rationally (?), but part of me also feels like, screw Doordash.