They're not a tech firm specializing in breach prevention, but a law firm handling breach fall-out, aka the PR/comms playbook. They probably know better than anyone that there's zero liability, so why spend resources or worry about preventing them?