Yes, there should have been more pen testing and reviews before such an important service was released storing lot of personal information.

I'm happy I was able to find the vulnerability within 4 days of it's public release