A related question would be, is this their minimally viable product. And how secure does a minimally viable product need to be?
OTOH, they themselves seemed to have said it's not MVP either, so I think that's okay.
I'm still concerned about the longer-term viability using the reasoning of "This many basic mistakes doesn't bode well", but time will tell.
I wish them the best of luck.