I would not be surprised if the files were not stored in a particularly secure manner. The publisher probably never anticipated PII being in the PDFs for print. They probably have an indefinite data retention period.