In fact users did get other users' data just by using the app normally, so it likely didn't happen the way you describe it.
But what GP seems to be asking about is: “Would having your app always encode a user ID into the endpoint have helped?”.
I originally thought they were trying to cache account data responses and so wondered why they wouldn't just use unique query parameters in that case. Definitely risky business though.
Out of interest, it looks like Cloudflare offers some sort of token authentication to authenticate at the edge: https://blog.cloudflare.com/token-authentication-for-cached-...