If they're relying on multiple weak pieces of information like this for security, they still aren't secure, and now they just created a huge pain in the ass for

If they're relying on multiple weak pieces of information like this for security, they still aren't secure, and now they just created a huge pain in the ass for any user of their system, as they have to somehow know all the pieces of information which are supposed to be secret. Huge-pain-in-the-ass security doesn't tend to work very well...