Just because its offering some useful service doesn't indemnify the ownership from the bad methods they use to deliver the service.

Exposing your database to the internet with default creds is not "standards and best practices" - its highly negligent, and if you are taking people's money for such a service, I have no pity for you.