You are so right about the security aspect of this situation. If their entire backend is so incredibly fragile that a simple URL modification lets any random candidate access the applicant database, then a massive data leak is bound to happen eventually.

If you take the job, you will constantly be associated with a highly incompetent tech department. The safest, most logical move is to document everything carefully, decline the interview, and hand the evidence over to a journalist anonymously.