> Don't they have any sort of vulnerability assessment or security code review?

I bet people just don't realize that the frontend code could end up being a source of major data confidentiality vulnerability. The threat modeling, auditing etc. usually just concentrates on attack scenarios involving the backend to save money and keep frontend development a bit lighter on the security review process side.

Does not make it excusable of course, just means their threat modeling was inadequate. But probably explains how this was able to sip into production.