They obviously had a lot on their plate, what with being extremely busy removing OtherOS and taking Geohot to court. How could they possibly find the time to fix obvious security flaws in the core of their backend. Pfft, I know that it would be my LOWEST priority in the face of hacker backlash.
Don't be too harsh.