So be it. Publicly disclose the vulnerability and stop doing business with them.
And publicly disclose that the publicly available software contains the password in plain text could have been construed as aiding a criminal offense.
He was ordered by his customer to look into logging problems.
He found the password in plain text, looked into a database he thought contains only data of his customer and found it‘s data of other customers too.