You'd think with a $1B valuation they could afford a pentest