The article and source material are light on details here. My guess is that it is using HTTPS, but the researchers saw the plaintext password in the request and assumed “password in plaintext always bad”.
If the app isn’t using HTTPS, then the story would be much bigger than just the password being plaintext.
If the app isn’t using HTTPS, then the story would be much bigger than just the password being plaintext.