I'm guessing they must have bypassed the built in WordPress update mechanism for that to occur. The WordPress update system obliterates everything in the folder during the upgrade as a (sensible) security measure to stop stuff like this from happening.

Props for going public with it though. I see far too many people either trying to cover stuff like this up, or even worse, just ignoring it and declaring it's not their problem :/