Yeah you're right, Coinbase is definitely insecure as evidenced by this.

The fact that lax security has never caused them to loose billions of dollars of customer funds is just luck and paper covering passwords on a whiteboard.

Yeah. Lots of stuff exposed stuff out there can stay exposed for quite a long time without being targeted or noticed. I've found quite a bunch and usually all it takes is... looking. Just one of those weird things about the modern world.