They hired the wrong developers. No educated developer would EVER store passwords in plain text, at any time... ever. The fact that this happened is just wrong.
In their report, they use the word "logs", so this suggests that the developer(s) involved were logging the activity, likely to plain-text log files, storing the passwords in the log entries. This was probably not a login database that was involved, but log files used for debugging during development. Still wrong, very wrong.
[doublepost=1555612860][/doublepost]
You realize these were Instagram passwords that were exposed, right?