Laughing a feature that lets an inevitable attack access 500 other people's info for every comprimised account is a glaring security failure.

Accounting for foreseeable risks to users' data is the company's responsibility and they launched a feature that made a massive breach inevitable. It's not the users' fault for opting in to a feature that obviously should never have been launched.