Earlier quoted context omitted.
Maybe, but running unauthenticated databases on the public internet is negligent at best.
No. It could be simple ignorance. Or an accident. In your world, what is it at worst? Criminal? Capital?
Of course it depends on the context. I don't know if it's reasonable to expect a small family clinic, therapist, or dental office to secure their client information. It seems that people just mass scan the internet looking for already known vulnerabilities.
However, if it's a mid-sized business handling important information, like payment information, then I do think there ought to be a standard of dutiful behavior, because otherwise who pays for the externalities?