There is a big difference between "bad security practices" and "someone made a mistake 2.5 years ago"