You’re right (and upvoted accordingly), but if said evil company is as much of a clusterfuck as OP said, I wouldn’t bet on them having competent security measures in place.