It’s likely that HIS credentials were revoked, but anyone in IT will tell you there many systems which are accessed by a shared direct username/password login, and yes while that should be changed when needed a much easier solution would be to lock those apps/sites behind a VPN which is much easier to revoke access to.
It’s also misleading because, while his character name was in fact Lex Luthor, he completely sucked balls and bore no resemblance to any reputable version of the character. And I should point out I do not dislike the actor, but that version just… failed in every way a character can fail.