I'm really torn by this one.

MOA is a business, and not public space (by some definitions). They aren't a highway, or a park, or a beach (or at least public versions of those examples). And they can conduct their business any way they wish... just as any of my local malls, or gas stations, or grocery stores are businesses. If "security" for a business asked such follow-up questions (at a Best Buy, or a Home Depot, or wherever), at that point, I have the choice of conducting my business there... or not.

On the other hand, these businesses also have to follow the law. If a private non-LEO security guard shared private information, and this sharing violated a law, I look forward to that business being litigated into debt or even bankruptcy. And it might also be the discovery process, to identify if private entities are permitted to treat their customers this way.