I don’t think that’s likely. The recurring theme with these right-catering sites seems to be “we put all of our user data on a public bucket,” at which point a Twitter rando tends to find them with a Shodan search or Google Dork. Which is the telling part: it’s infrastructural incompetence, not exploits in Mastodon or whatever software they choose to run.