Just a run-of-the-mill dev trying to get on with a day, and normal management chain with an IDGAF attitude, and a lack of oversight and audit for the critical parts like these. Small companies have little funds to dedicate resources to things, so priorities must be set and critical parts must be reviewed and audited and tested and reviewed again. Someone did not know or think much about the only job that product had, be secure and random