Google+ bug exposes non-public profile data for 52M users (arstechnica.com)

What I don't understand it is how this happens if you get a testing process carried on. In a company like Google you would expect a lot of people trying to test and hacking things out projects to are meant be public interfaces