Is it still commendable if in order to develop this, the taxpayer-funded developer themselves published our PII to a consumer, privately controlled third-party server without following federal data security protocols? Seems like an attempt to make up for the damage they caused.
Standing up your own AWS-equivalent internally is not much work, yet the PII data leaked to publicly available services due to this developer's personal choices and lack of oversight to prevent sensitive government data from being published externally.
Notably, this resulting work has not been published as public domain (CC0).
The purpose of a government is to serve its people, not make sure every business gets the same conditions at all costs. Picking winners and losers is fine if the losers still have a chance to beat the winners when they're really better.
If someone makes a free PII detector better than Rampart I bet the US government will either switch to it or make Rampart v2. For now it's enough. Perfect is the enemy of good.