I am kinda giving them shit for when someone pointed out that they're essentially storing PII completely unsecured and their response was "you should use app isolation anyway". That is not a good security model.