This is a security flaw for sure, but it’s not nearly as serious as the article makes it out to be. You have to know the person you are targeting, you have to know which credit card they used to pay for their subway credits, and then you have to know the credit card number of that credit card. If you are in a position to know all that, then you are probably already in a position to stalk them using other/superior methods.