I've been wondering the same thing about Snapchat. Acknowledging a security risk publicly and then not addressing it sounds like negligent conduct. Then again, I'm not a lawyer, and I'd guess if there was money to be made in a class action lawsuit someone would have started those wheels turning already. It does raise a concerning proposition: if any of us can be held liable for "leaving the windows open", who gets to decide when the windows are left open or not? Having to launch each and every app with a whole slew of security features before opening it to the public could end up stifling innovation.