Because they were available on the public Internet with a widely known easily guessable/brute-forceable password in 2026.

And then leaving them there after a well publicized breach happened?

If it was 2002 it would be embarrassing, but not unexpected. This is pure incompetence.