The common question I get asked from my clients when stuff like this comes up from their end to end coded slop is "ok, but like how easy is it to access?" and then I say "quite easy" which is usually followed up with "how long can we get away with it?"
They don't care. If they can continue pulling cookies from the jar right up until they get caught they will continue to do so. The AI Agents, still to this day, cannot figure out how to build things without massive gaping holes or how to potentially scale something. AI can't do it or rather doing those things goes against it's initial instructions from like OpenAI, Anthropic, etc to provide the user with the quickest possible solution. Remember these agents don't need to provide ACCURATE or safe solutions, they just need to provide SOMETHING.
You can try to prevent security exploits and what have you via your prompts but that's a coin toss if the agent is actually going to do it and simply not claim it has done it an then you later find a #TODO in the code where the agent claimed it did do it but simply just added a comment. your average vibe coder isn't going to know how to look for this or even how to fix it or provide a better prompt to ensure it might happen.
It's the blind leading the blind. vibe coders are just project managers that learned how to download sublime text.