I dont think it's a security issue. VAT numbers are public (like registration numbers for companies), it's just that every country keeps its own registry, and this is a tool to verify that a VAT number is valid.