He didn’t do business with them, his customer did.

And publicly disclose that the publicly available software contains the password in plain text could have been construed as aiding a criminal offense.

He was ordered by his customer to look into logging problems.

He found the password in plain text, looked into a database he thought contains only data of his customer and found it‘s data of other customers too.