It is institutional in the sense that Flock and the individual PDs have not put steps in place (either post auditing or pre not allowing bad queries) that prevent the abuse.

Post auditing is obviously not taken seriously by these departments, and Flock could build tools to do this out of the box (identify weird search patterns) if they wanted to.

Edit -- I see Flock does have some audit tools, https://www.flocksafety.com/trust/compliance-tools. If those work as they should, it is more on PDs to use them properly.