GAO's latest report found Treasury didn't follow basic security protocol in granting a DOGE staffer access to sensitive payments information last year.