Just when you think Apple's utterly incompetent engineers can't get any worse, they reach a new low.
Showing users resources that belong to a different user is the number one most catastrophic fail you can possibly have in a multiuser service. They should be fined out of the eyeballs and NEED TO FIRE the engineering/product manager(s) that presided over such a disaster.
I should point out that, at least in the EU, a data breach of that magnitude should alone warrant a substantial fine.
Horrifying. Absolutely horrifying. This just doubles me down on the "my current Mac and iPhone are the last pieces of Apple hardware I'll buy" stance - their software is just utter, utter junk now. It's not worth the money or the stress.