Why is this garbage?

Because it's sensationalist fearmongering from a source with no particular credibility. There's no details on what the vulnerability is, where it is, or even what the risk of not clearing all the credentials is. Nothing in the original Mastodon thread suggests any actual competence on part of the reporter, a bunch of things suggest a lack of competence.

If there was a real and urgent issue, Amazon I expect would have had to make a statement by now or risk regulatory action. (E.g. the GDPR requires public disclosure of data breaches within 72 hours). They haven't done so.

Right now this is indistinguishable from some random dude complaining about a minor bug to Amazon, feeling Amazon is dismissing him, and hyping up the issue to try to but pressure on them.