The security blunders are obviously horrible, but MAYBE explained by inexperienced developers tasked with something way beyond their understanding.

But how on earth did anyone approve storing confidential customer documents in an email account? This seems to indicate there's nobody in charge that understands anything about how to run this business. And if it's a subsidiary or outsourcing partner, it also shows that nobody has ever audited this business.

This is criminally negligent behavior from the company owners, and whoever is contracting them to do this work.