What's bonkers is that _your own data_ was also accessible. Who's to say other users didn't get that data and choose to not report and kept the data?

Your own outrage to your data being exposed would have been perfectly reasonable.