Holy crap, so if a h4x0r breaks into that website they can see the income and assets of every citizen of your country? That's nuts.

The IRS sucks, but believe it or not they're smart about keeping data secure. The massive mainframe into which all that employer-related data gets loaded is not web-connected.

In fact, not even IRS employees can access the data in there via the web. The only connectivity is through (fairly) dumb terminals with a chip-card slot. The chip-card signs each query before it's sent to the mainframe. Yank out the card and the terminal will cease to respond to your commands. The chip-card is also their employee badge.