> So then it’s seems it’s either that this was intentional(ish) or bad security

My take - don't attribute to intention that which can be sufficienty explained by inexplainability or incompetence (although I doubt the latter).