>> If any security check depends on this data by considering it as a secret, then I guess it's the fault of that security check.

That is very small solace when you're the victim, regardless of the failures of others. "But you shouldn't be using that data as validation!" is not the first response when say, you find out someone's opened a credit card in your name with a $20K balance. Or your friends & family get phished (especially with the help of AI) because they know so much about you it had to be you.