10 years ago, that was believed to be best practice.

If they’re still doing it in the last 2-3 years, they don’t have anyone keeping up with modern security standards

At least it’s not your data