It's careless design, but at this point the business model can't be pivoted to privacy or security. It would simply cost too much to build and it would harm revenue from blackmail and extortion.