Are you, as an engineer, going to sit back and watch the project you built (containing very personal information in this case) get compromised? Even if you know management isn't paying proper attention?
See, that's the problem with every developer in Silicon Valley calling themselves an "engineer"; they want the title without the obligations that a professional engineer has. "Not my problem" would cost you your designation.
All engineers make mistakes and misjudgements, even the ones working in long-established fields, as we can see from the 737MAX saga. It's management's job to design a organizational structure that puts enough safeguards in place that mistakes get captured before the product rolls out. That's what management literally means.
How does this work? Do you rip off your glasses, strike a manly pose and run for the data center, stopping only to force the infra team to give you the credentials?
More seriously...
Organize your own IR tiger team outside of management channels? Congrats, you're unemployed tomorrow, together with anyone silly enough to buy in.
Start making rogue code changes you think are appropriate? That would run in to "want[ing] the title without the obligations". Oh, and also probably end up with you unemployed.
So, really, what are you proposing?
This gave me a good laugh, thank you
I'm glad I'm not the only one who feels like this.
I nearly got fired by digging my heels in on a privacy/infosec flawed design... until CTO/CIO layer gleaned what I was freaking out about and the energy (angry, "wtf", etc) suddenly pivoted to the original architect and engineers who cooked up some half-baked stuff.
You don't want your name attached to bad stuff in life. You only have one reputation. Don't mis-spend your social (political) capital by letting dummies bully you into ignoring tangible security issues.