Interesting story, but I think the researcher who found the flaw probably doesn't have much experience with large organizations, he says they didn't take it seriously because it "shouldn’t take over an hour to contact your IT guy and kill an rsync daemon." After he called the CEO. I'd say an hour is an unreasonably aggressive timeline if you're contacting the CEO... it likely takes some time just to figure out who needs to shut off the service.
These stories are always disconcerting, especially, after having been a victim of a data breach myself, although covertly, in 2015.