Or how about "we moved to an open source library or third party auth provider to host all our user data. We learned we didn't want to be responsible for such a critical security area."

There are lots and lots of options. Seems like they are a php shop, so even moving to any of these open source PHP server libraries[0] would have been a better move.

Disclosure: I work for a third party auth provider, FusionAuth.

0: https://oauth.net/code/php/