It is negligence, but information workers have very little regulation when it comes to handling personal data (outside of specific fields, like healthcare and finance).

I say this as an information worker who handles a lot of personal data. Worst case scenario, I get fired and can't use them as a reference. Unless I'm intentionally stealing data and using it for crimes there's no risk of criminal penalties.

We needed privacy laws 20 years ago but the tech bros assured everyone that it would be fine and for a long time they were mostly responsible with our data. But now we're well into the enshittification of the Internet and the lack of regulation is allowing these kinds of harms to become common.

Though, in a sane regulatory framework Tea wouldn't be allowed to exist in the first place. The entire point of the site is to doxx people and share personal details about them without their consent.

At least some of the negligence is on Google, for the atrocious default security settings in Firebase

The vulnerability is called hospital gown because they leave the back end wide open by design. It's not even a traditional vulnerability, since it's technically working as intended