OpenAI is run like a YC company. That means they do everything not to distract the user from the core workflow. I think privacy and security are just very low priority to them.