I'm not sure that article is saying there were 500k users. It reads more like there 500k users had granted access to an app that had these permissions. It seems hard to imagine that a bug like this would be affected by whether a user is currently active or not.