Ok, I will bite. What specifically was the lack of security on Marrriotts behalf.

So so far you have stated that your account was hacked. How? Then you tell us that Marriott made good on the stolen points, which they likely did NOT have to do. That seems like a real win for you given the situation.