From the description, this wasn't one line of code, this was a major design oversight. Either nobody is security conscious on the dev team handling their mobile

From the description, this wasn't one line of code, this was a major design oversight. Either nobody is security conscious on the dev team handling their mobile/web services, or it's just one guy with no code review on major components, or people who complained were tuned out, ignored, placed in low priority, or some other totally irresponsible managerial action. You have to have a lot of bad process in place for something like this to get in.