The hacker leaked their source code onto github and said that only 2 out of 3 of the CVEs he was using was patched: https://github.com/holo-gfx/mangadex/issues

Other people who are now looking at their code said there are numerous other vulnerabilities. I guess that's why they decided to burn it to the ground and rewrite instead of trying to fix everything.