Accepting poor security practices from the Linux mint developers cannot be justified just because you are not paying anything.

Open source projects need to be held to the very highest security standards.

How these security breaches are handled today set a precedent for how such security breaches are handled in the future. So it's a good idea to learn and improve from such security breaches and set a positive precedent.