I think the HN-framed takeaway here is that the developer building the system could have used a timestamp + HMAC and prevented the issue, but chose not to for whatever reason. Maybe they wanted to be able to generate barcodes from the app itself while offline, maybe they were getting the data from the server anyway and just didn't know any better.