That might not be the point. The point might be to allow the intersection between what is palatable for the company and what serious exploits white hat hackers can come up with.<p>No company wants to include in their privacy policy that anyone can legally access and download your data if they are trying to perform exploits on the system.