The author says "I refuse to believe they’re unaware of this. This doesn’t feel like an oversight, it's either a deliberate design decision or they just don't care." Agree that this is an uncharitable way of looking at it.
I've worked in lambda web editor (not in Git) and my lead considered replacing sql injection with parameterised queries was a distraction/insubordination. Cant wait till audits, data breach insurance and imprisonment becomes the reality.
Lazy API that did not vet a simple backdoor?
Good coders but accidentally pushed the debug version of the API?
I am going to have to say the second option feels less likely (yes, I have been called cynical).
It was just an example. Maybe they knew.