Maybe the fish tank shouldn't be on the same network as high value assets. That way, vending machines could be accessed by the fish tank but not the mission critical data.
It's likely that was the protocol, but it wasn't followed. It usually comes down to actions of a Pointy Haired Boss rather than some glaringly obvious hole in their security plan.