One of our company sites redirects all bad URLs back to the login page which is required to even access the site. Is this insecure? It feels like it may cause some weird issues as I have never seen this before or at least be bad practice. For example https://www.google.com/fndnandas would redirect to https://www.google.com instead of showing the 404 page as google does.
I wouldn't call it bad practice or insecure, unless your login page is insecure, but then redirecting to it doesn't increase your insecurity.
What the blog is alluding to when it says:
Someone is trying whether your site can be hacked through a certain URL, that 404 is 100% the right thing to serve.
Automated scanners will see the successful page return as a type of success, meaning that the scanners will continue to scan and try different hacks, since they are all "successful".
So, it could be that an automated scanner that has been "encouraged" to keep trying might end up finding a vulnerability in your site that it might not have found if you returned 404's, but scanners are not easily discouraged. Scanning is free and easy, so there is no cost in trying all vulnerabilities, regardless of what the page returns, even a 404.