The article mentions it was because their Firebase database was unsecured - meaning anyone who knew the url could get access to all the data. That was the default for a long time, and Firebase will send you email reminders if you keep it unsecured. The developer ignored the best practices mentioned in the Firebase documentation and the email reminders that come out once a week (I think).

while i suspect a couple layers/points, i can't zero in on the major specific point of your sarcasm/humor.

"The data was accessible from a public and exposed Firebase data repository, which was hardcoded in the app."

Crypto wasn’t involved - this was just a publicly available database of all their users.

The crypto version of this I guess would be to store the plaintext copy of the encrypted content as metadata on the “encrypted” content?

No amount of correct encryption or (in this case) API access policies saves you if you just publish all the data publicly