This is irresponsible. He should have reported this to the vendor, not dropped it for all to use.

I feel like this type of "vulnerability" is so obvious it's on them for ever letting it get out.