I think they had been relying on lazy security by obscurity and it pretty much worked... until copilot