I do not believe any private posts were archived by the security researcher. From my understanding they were able to access all public posts, including ones that had previously been deleted (which was the bad part).

The other security faux pas was that they did not scrub GPS metadata from images or videos at all.