Doesn't this completely blow their "only a few employees have access to your data" stance out of the water? Doesn't mean that, for example, every one of their programmers has access to user data? If a presumably simple bug can give the whole world access to your data, then it can't be that difficult for any dropbox employee to access it (again, from the inside).