what if the real security lapse was teaching an entire generation of npcs that submitting their id to install an app is fine and normal