I see the blog post now says the following:

We also subsequently removed Google Tag Manager from the private pages.

This is good. However, the question then becomes how on earth did Google Tag Manager get added to those pages to begin with?

Either you did not consider this a cause for concern, or it slipped past your code review. In either instance, how could I ever trust you with my data?

That question needs a serious answer.