>> Images of these driver’s licenses are publicly accessible web addresses, allowing anyone with the links to access them using their web browser.

Not justifying it, but many applications consider the uniqueness of the URL enough protection to prevent discovery.

> Is this just bad development? Are these just things could be missed by any developer or team?

It's not knowing them. And when you vibe-code something, and don't prompt for it, it's not gonna do it.