How big is their dev team? Does their app change much? Could they have contracted it out and now only have one or two people who still push updates to it?
There is zero reason why any dev (or worse external dev team) should have access to prod secrets, or the ability to push out via prod. (unless someone cocked up the config for the dev/staging push notification tooling, again requires a level of access)