Because it is public and nothing prevented indexing. Search engines find subdomains through certificate transparency logs, links, and ordinary crawling. If the site responds, it can be indexed.
Why robots.txt did not help
A robots.txt file asks well-behaved crawlers not to index. It does not restrict access, it is itself public, and it effectively advertises the paths you would rather people did not visit.
What to do, in order
- Work out what is actually exposed. A staging site with a copy of the production database is a different problem from one serving placeholder text.
- Restrict access. Basic authentication is one line of configuration. Restricting by IP address is better.
- Only then request removal in Search Console. Removal requests on a page that is still public achieve nothing lasting.
Why it was there at all
Staging sites get created for a specific piece of work and removing them is nobody's task afterwards. The person who made it has moved on, and whoever inherits the domain does not know it exists.
This is the short version. The full guide covers it properly: read more.