U.S. airline accidentally exposes ‘No Fly List’ on unsecured server

I don't understand this. Perhaps I'm dimmer than most but wouldn't it have made more sense not to distribute the list but to have airlines query the database online on an item-by-item as-needed basis?