I suspect that the report is kind of misleading in claiming the expired certificate as the problem. A certificate can not be used to decrypt traffic at all but rather the private key matching the certificate is needed (for RSA key exchange at least, which I assume is done here).

Thus the problem is likely not the expired certificate but instead that the private key installed on the device matched the public key in the expired certificate but not the one from the new certificate. This is likely because the new certificate did not reuse the key from the old certificate but instead a new one was used - and that for successful inspection the new private key had to be installed on the inspection device.

I suspect that the report is kind of misleading in claiming the expired certificate as the problem. A certificate can not be used to decrypt traffic at all but rather the private key matching the certificate is needed. This is at least true for the (obsolete) RSA key exchange which I assume was used here - for inspection with DH key exchange one would need instead need the pre-master secret of each TLS connection and neither certificate nor private key would be usable.

Thus the problem is likely not the expired certificate but instead that the private key installed on the device matched the public key in the expired certificate but not the one from the new certificate. This is likely because the new certificate did not reuse the key from the old certificate but instead a new key pair was created. For successful inspection the new private key matching the new public key in the new certificate had to be installed on the inspection device.

Because of expired certificates, the Equifax IPS was unable to inspect encrypted traffic and detect the breach in time.

It is hard to tell from the report what exactly was going on but I read it a bit differently. I don't think that the expired certificate was used to decrypt traffic at all as you seem to assume. From page 3:

Equifax did not see the data exfiltration because the device used to monitor ACIS network traffic had been inactive for 19 months due to an expired security certificate.

In my understanding this describes a device which connects with TLS to some part of this ACIS network in order to monitor information. The certificate for this connection was expired so that the device could no longer connect to the ACIS network and thus could no longer monitor it.

I suspect that the report is kind of misleading in claiming the expired certificate as the problem. A certificate can not be used to decrypt traffic at all but rather the private key matching the certificate is needed (for RSA key exchange at least, which I assume is done here).

Thus the problem is likely not the expired certificate but instead that the private key installed on the device matched the public key in the expired certificate but not the one from the new certificate. This is likely because the new certificate did not reuse the key from the old certificate but instead a new one was used - and that for successful inspection the new private key had to be installed on the inspection device.