Apart from getting hacked by a SOTA AI, what did Hugging Face do wrong?

Allow private data to be accessed through public api