True, if you are incompetent enough to expose your most sensitive data on the internet yourself, why do you expect others to come to your aid. Even if Google does not index it, what is stopping other search engines from indexing or hackers to get access to it directly. There are lot of tools which will automatically index all the content of a website with the click of a button. So I think it is best to put the onus on the website collecting the user data to protect it. If they cannot, then maybe they should just use some third party authentication and minimize the amount of sensitive data that they need to keep on their servers.