If your customer base is doubling every few weeks, that's simply not enough time to hire more engineers, onboard them, and get their resources focused on optimizing the stack to improve efficiency. It's also way more realistic to scale up your infrastructure in the short run until you know you've stabilized at a point where you can purchase and operate dedicated hardware to offset the steep margins cloud providers charge.
On top of it all, their product itself seems off-putting to a large portion of tech workers, which would make hiring talented individuals even harder.
It seems they did not set a sufficient foundation for such a possibility, and got caught unprepared.
My understanding of the scraped data is that some APIs used both sequential keys, and ignored both permissions and their soft delete flag. It’s not clear to me whether or not that API was permanently unauthenticated, or if it failed open once Okta locked them out.