Comment by hqsolomo

Security neophyte here- you are exactly right. It also seems like in this case there was a "default encryption key" and is 100% a part of the problem