Tech experts argue that the Medicare statistics portal’s code was set up to send data to anyone who requested files, including data that wasn’t promoted.