Back in 2000 I worked on a website that had a secret page where you could enter any SQL statement in a textarea and it would be executed and the results returned to the page. This was claimed to be necessary for "debugging" and "support" but the only protection was that the URL was not linked anywhere else on the site.

I would not be so sure it's NOT security through obscurity. Whether it is or not, the Borders case is just another example of why it's no longer prudent to trust ANY online service with your personal data (though most of us would probably not think that signing up for a Borders Rewards card would create an online profile).