since botting is so easy, probably they used a lot of accounts to access data that, in theory, is somewhat public. I mean, in an ideal world in which engineers have infinite time sure, they would have noticed, but I do investigations on platform apps for work and trust me, they miss a lot of more fundamental stuff.