To be fair, iirc the reason for that was that the VR file browser was a demo and the creators had not set up file access restrictions properly like they did for the normal method of access. As a professional software engineer this seems very credible.