But it's such an easy vulnerability to avoid, that if they're not avoiding it you have to ask what else did they gloss over in their system? "Felt sloppy" is exactly right, and the assumption should therefore be that the entire system is sloppy.