I wouldn't know if it is malice. We won't know unless somebody catches them red handed with an email to prove it. But I don't think it is malice. The engineer

I wouldn't know if it is malice. We won't know unless somebody catches them red handed with an email to prove it. But I don't think it is malice. The engineer in me says that there are just too many eyes looking at the software and that it is just too easy for somebody to identify a password and that the consequences of it are too costly for the company. And I can think of a zillion ways to leave a backdoor that is much more difficult to detect. Of course, this does not absolve them from responsibility in any way. The core responsibility, the core product they provide is security. And not only they are showing they can't provide a secure product, they prove they simply do not learn and do not care to fix it.