Not trying to say he shares no blame, but the code gets reviewed, approved, merged... ideally not by the same person who wrote the code. And then it sat broken for 5 years. Where are the security audits?
He made a serious mistake. He wasn't the only one.