It sounds like "we don't like it and won't tell you why, we're hiding behind MIT policy and vague notions of privacy".
MIT should just demonstrate in a paper what the shortcomings are and print it, adding it to the citation tree of the original.
Looking very briefly at the paper and speculating wildly, I could imagine that the company who were subject of it - or their staff - might not appreciate it and have put pressure on MIT??
Solid amount of Streisand Effect going on here -- lots of attention has been bought to the paper (and that is everything after all!).
The apparent issue is that the data appears to have been entirely fabricated and is a lie. The author appears to simply be a fraud
(Incidentally, I don't think misplaced trust in preprints is much of an academic issue, people that are experts in their field can easily judge quality for themselves. It's laypeople taking them at face value that's the problem.)
FERPA is federal law. It is quite likely that MIT is legally bound to not release some pieces of evidence which are crucial in this case (hypothetically, for example: that the student's educational record is inconsistent with claims made in the paper).