So the company that actually maintains and fixes these databases is lying? Read the post, "saving" data means a different thing here.
Read your own link from VAN:
We immediately began an audit to determine if any users had intentionally or unintentionally gained access to data they normally would not have access to within the limited timeframe when the bug was live. Our team removed access to the affected data, and determined that only one campaign took actions that could possibly have led to it retaining data to which it should not have had access.