I honestly don't know what the solution is. Making a good user experience (read: convenience) and keeping your stuff secure is always a balancing act. I can't tell you how many times I've told a manager or director not to do something because it would make our client data insecure, only to have them basically reply with, "I'm your boss, do what I say."

This guy may have known exactly what he was doing, but relented to other higher ups who told him to do something. The shitty part is now this is public, all the execs can point to the developer and say it was his fault and fire him without incurring any repercussions themselves.