This isn't a problem with Chipotle's web site. It's an issue with the autofill program not entering the right information. Credit cards only have two year digits on them, it's silly to enter 4 digits. Autofill programs fail all the time, it's not the site dev's problem.
Additionally, the idea that they're losing 0.5% of orders die to this comes directly from the "bug" finder's posterior. He sounds like a real idiot.