> This doesn’t feel like an oversight, it's either a deliberate design decision or they just don't care.

Having a complete lack of any authentication and sequential IDs does seem like a design decision.