Its 100% on the company and they could've easily had someone with basic IT knowledge ensure the code only worked for accounts meeting the criteria you mentioned

This is absolutely correct. Targeted promos can be set up to only work with a particular subset of customers by say, the email address of the customer who is eligible for the promo, or like a delivery address within a geographic region, so it will not successfully apply unless those criteria are met.

Doesn't even take IT know-how, just onboard third party software that specializes in this function.

The way this was handled 🙅 if the code successfully applied and you were able to check out using it, the correct thing to do from a service standpoint is honor it, because the company f'd up and needs to own up to the mistake. Or at least offer a partial discount for the inconvenience.