I've heard of much worse security no-no's. The worst example I'm familar with is of a Fortune-500 corporate database with data for millions of private citizens

I've heard of much worse security no-no's. The worst example I'm familar with is of a Fortune-500 corporate database with data for millions of private citizens exposed for years on the public web over plain old http (not even https), without any password or public/private key protection, such that anyone anywhere with the right URL or IP address could access it. The big question, of course, is: Why haven't we had a security apocalypse? I imagine it must be because most software engineers are honest, and because the bad actors who have the skills and resources to pull it off (e.g., foreign government agencies) have a vested interest in maintaining the status quo. So, non-technical managers everywhere go on with their lives thinking their software infrastructure has been "secured," without really knowing whether it's true. Consider that no executive or manager at Hyundai was aware until now that their vehicles have been using a previously published private key to update their software.