In the aforementioned TNG episode "Booby Trap" the Holo-Leah Geordi creates is based of her public/open professional logs. When he's talking to Leah (before she is created and only speaking to him) Geordi asks her for the "real story" on something she mentions and the computer chimes in with, "personal logs are restricted access" or something to that effect.
So it's pretty damn absurd that Bradward was able to get access to the personal logs of the entire crew to create perfect simulations of them and to get personal, private, information about them like Mariner being the captain's daughter.
At least hypothetically, it seems feasible that Geordi didn't have access to the personal logs of Leah Brahms versus Boimler potentially having access to the personal logs of the Cerritos crew. Some thoughts:
1. Brahms is not a member of the Enterprise crew and there is no particular reason why her personal logs would be part of the Enterprise's databanks. Whereas obviously the personal logs of the Cerritos's crew are part of the Cerritos's databanks.
2. The Enterprise as the flagship of the fleet has the highest standards for everything in Starfleet, including addressing privacy concerns. The Cerritos isn't so strict.
3. "Restricted" doesn't necessarily mean "completely inaccessible." If for some reason Geordi actually needed to access to the personal logs of Brahms, I've no doubt that he could have gotten it eventually.
Boimler is apparently an awkwardly-inept genius, not a stupid or cunningly evil nemesis.
His tinkering with the holodeck and the creations of the crew, were meant to be for his personal use to help advance his career.
He never expected anybody else to take what he had done and modify it, so he probably didn't think using personal info was that big a deal, since nobody else would know and he wasn't actually looking for intimate details.
(just like Barclay did)
Everything that happened after that point is on Mariner, including letting slip her relationship to the Captain.
<side note>
I have to go back and watch episode one again, I thought sure by the end of that episode Bradward had realized that they were Mother & Daughter.
(which is why he didn't tattle on her)
We have to handwave that to achieve Boimler's objective, kissing up to the Captain and acing his interview, there is absolutely no need to download the personal logs -- or really any logs -- of any crew member. He could have just done a sim of Freeman and practiced interviews with it, and directly asked it questions like, "How can I ace this interview." Of course, then the episode wouldn't have happened.
Anyway, regardless of his intentions, he apparently managed to circumvent whatever lockouts were there. It's still his fault.
I'm not really sure accessing personal logs is really a "security problem." It's an invasion of privacy, but not a security issue. Anyway, the conceit in the episode is that the computer accessed the personal logs to create realistic representations of the Cerritos crew without Boimler actually reading them. After all, he was completely unaware Mariner is Freeman's daughter until holo-Freeman mentioned it towards the end. And I doubt doing this is against Starfleet regulations anyway since there's no way Boimler would actively and intentionally break the rules in such a manner.
If one can access personal logs of people as freely and apparently effortlessly as Boimler did, there is no telling how much blackmail material is in there. For instance, we learn that Freeman was desperately trying to hide that Mariner is her daughter. What other secrets does the crew have and how far would they go to keep them? Being vulnerable to blackmail should definitely be a security concern.