Doesn't surprise me
I'd love to say I was shocked that the NHS would use live data for a demo but I'm really not. I worked as a contractor doing development for the NHS about 10 years ago and we used an old backup of the live database for development & testing. No anonymisation at all. The only protection was there were no records for anyone in the local area where I was working, that didn't stop me looking up the records of an ex-girlfriend from further afield to prove it was an issue.
I also worked for the Home Office at one point on a project to digitise old criminal records. Again their idea of data protection was not to include any records from the area where the work was being done. I was born and grew up 250 miles away and was able to look up all the records for my old home town going back 90 years.
This is just business as usual for UKgov.