>However, Tea could have done a modicum of cybersecurity work (or hired an outside firm) to prevent this.

I have no doubt in my mind that this is what they did. An "outside firm" vibe coded this and delivered the results.