> Is it considered apropos to state how surprised you are that developers who come across as relatively senior are capable of making an incredibly fundamental security mistake such as this?

Only if you're concerned that you can't tell who is "relatively senior." In this case, your judgement was unfortunately wrong.