I can understand that you are pissed of because you lost your funds but this issue has nothing to do with Authentication, Accounting and Authorization. You gave your private key to an untrusted third party. Thus Authorization is not the problem here because with the private key a bad actor can steal your funds regardless of the password protection.
You obviously don't understand even basic concepts. Can you read your email without a password to your account? No.
But worse than that, how could a private key aka seed be used to openly login to ones account/wallet? That is plain irresponsibility of the IOTA developers and they are the ones to blame.
Given they are a registered "Gemeinnützige Stiftung" according to German law, they are likely to be safe from being sued for that, they have nothing to compensate for the losses. But this does not mean they get off the hook.