Not suprising. When I worked for an Xfinity "Branded Partner" they played it fast and loose with security. During training, a trainer on equal level ranking as a national director told my class full of new hires we should all make our secure internal-use Comcast account password "E@sypassword1", and later in the class told us that if a customer forgot their phone in their car we should just bypass the 2FA completely. why? Because there is a tracker on the door that tracks how many open/closes linked to the conversion rate. The conversion rate was considered more important than properly authenticating accounts. Im pretty sure Comcast knows about this and does nothing. Needless to say, when I made my concerns known I was terminated same day for "not being a good fit".