It's basically a "KISS" issue.

The data being submitted is so simple that using an SQL db adds a layer of unnecessary complexity.

So did their decisions for authentication, which appears to be where things got stuck.