Yes. LLMs are very much like a smart intern you hired with no real experience who is very eager to please you.

Even at 20 years old I would not have done this.

One who thinks "open source" means blindly copy/pasting code snippets found online.

It's definitely both. A bunch of 20 year olds were let loose to be "super efficient." So, to be efficient they use LLMs to implement what should be a major government oversight webpage. Even after the fix the list is a few half-baked partial document excerpts with a few sentences saying, "look how great we are!" It's embarrassing.

> At least my experience is that ChatGPT goes super hard on security, heavily promoting the use of best practices.

Not my experience at all. Every LLM produces lots of trivial SQLI/XSS/other-injection vulnerabilities. Worse they seem to completely authorization business logic, error handling, and logging even when prompted to do so.

Apparently they get backdoors in as incompetently as they create efficiency.

They did, and this is what they got.