This says that Atlassian are not running good static analysis on their app source code. It also says they have either no good peer review, or their developers

This says that Atlassian are not running good static analysis on their app source code. It also says they have either no good peer review, or their developers have no awareness of basic security. Any decent SAST tool will flag up things like hard coded passwords in most instances. A normal security audit of the app without access to the source code is unlikely to determine that. You would have to reverse engineer the app.