Anybody with your hand raised should be ashamed of yourself because I bet it's not true :)
Sure they should fix this -- but is this something they should be fined for? Or be DDOS-ed by Hacker News readers? Or GDPR reported for?
It's just not a great way to get help from up and coming businesses to force major financial pain on them and it's certainly not empathetic to what's likely a hard working, reasonable set of people on the other end of this service.