They could have started simpler with app passwords that provide read only access. They purposefully drug their feet under the false principal that they own their clients' data.