When you send people secure information through any means, you are accepting that the security of that information is now equivalent to the worst level of secur

When you send people secure information through any means, you are accepting that the security of that information is now equivalent to the worst level of security practices of all the people who received that information. When the recipients are a large collection of random strangers on the internet, you should assume the data is as good as public, because the average random stranger on the internet has terrible security practices (not to mention the non-zero probability that they're actively malicious). 23andMe could have done a better job communicating the risks of sharing your data with random strangers on the internet, but it's also not unreasonable for them to put some level of blame on users. If you wanted to treat that information as secure, you shouldn't have opted in to sharing it with an arbitrary number of strangers.