They gave their employee the ability to bypass the security PIN code locking the account. If they hadn't touted it as account security, their case would probably be better.