Not familiar with this particular system, but if the issue is that their whole webapp is pwnable spaghetti, then I doubt it's gonna come back online anytime soon. Those types of issues are usually endemic and no amount of whack-a-mole will fix it.
Really depends on the devs. I've seen it go both ways. But you are right, most retests I have done after the pentest issues were fixed is weird. They actively engineer around our suggested fixes instead of actually doing the work they are told to do