> If he tried to convince them to pay for a consultant to tell them the same thing, things might have been different.

More people in the industry need to realize these kinds of hacks and start playing the game. Management will back you on almost anything so long as you make it look like a win for them.

You want security vulnerabilities addressed, ask for a pen-test and then tell the testers where to look.