The people who hired the person who can't drive and gave them a job as a driver.

> do you have any reason at all to believe the backend people didn't know?

Well, either they knew and wanted to implement proper auth and were prevented from doing it, or they knew and couldn't be bothered, or they didn't know that their backend system wasn't properly locked down and were too incompetent to have a clue.