You're basing this off a 3yr old security review of a 2yr old startup (at the time: founded in 2013, reviewed in 2015)? Got anything more recent? 3yrs is a lifetime in startup years.
Plus they now have plenty of money to hire the best security firms to pen test their systems, plug holes, and run a serious monitoring operation.