Speaking as a former game & software development, it actually makes sense why they'd do it if you're making a few assumptions that the Square devs might.
-The ID may be getting sent to the client, but in a vanilla client, it's irrelevant - there's zero way the enduser has any possible way to access it in any way shape or form. So on a theoretical level, it'd be a very safe thing to do. Even if they theoretically could access it - without insane documentation of the game code, the enduser would have effectively zero idea what they're looking at amongst the huge swathe of other variables & data being sent over. Honestly, you'd be utterly terrified how many very large & widely used programs out there use/have used similar tricks with data you would normally have zero method to access/easily obtain that could be crippling if they fell into the wrong hands (and quite frankly, have before being patched out.)
-Client based leads to less Server I/O operations overall by a huge margin. Given their talks in the past about how adding even 1 extra slot of persistent inventory is a very large undertaking that they have to spend lots of time QA'ing and testing, I have little in the way of doubts that Server I/O is a huge topic & pain point they have to plan lots of things around, since every little thing being added to a player magnifies Server I/O by titanic amounts due to being done to every player online every couple hundred milliseconds. Thus, going for a client solution makes much more sense, especially given the above point.
Their biggest issue is that they severely underestimated just how ridiculously documented the game has become to plugin developers. (And also being frank, just how many of these people have large amounts of time on their hands to spend doing this in the first place) Massive de-compilations & analyzing over the years by 3rd party peeps has basically outlined every single struct/function the game uses within the client so the plugin developers can see every tiny thing that's added to the game each patch as part of their plugin fixing routine. So finding the Account ID variable was super easy because it came with all the new stuff, putting way more visibility on it comparatively.