Yeah, it sounds like some well intentioned but extremely misinformed and unskilled (in the context of software and systems engineering) people just vibe-coded the thing together, and (shocked pikachu) it was a complete piece of shit security-wise.