What's the point in encrypting user data in transit if you're just gonna leave it unencrypted at rest??

Basic HTTPS does the trick of encrypting transfer, easy as fuck to set up, does not mean the app is any more secure tho.

Database encryption is usually not necessary if it is kept on a private network. Setting up sensible auth is usually enough. They kept some doors unlocked, tho.