Top tip for any all companies: when someone with a good reputation and a background says you're doing it really wrong, and then half of the nerdy internet agrees, listen to them. It'll save a lot of trouble later on.

I wish I was surprised that Tesco haven't fixed the XSS attack, but it's probably languished in management hell for a few weeks until it's deemed necessary. Bolt the stable door before the horse does a runner.