This is obviously speculation, but development does not require direct access for a pivot to production. CI-Systems might be reachable from dev and I often see CI-Systems that are less well secured than prod. Pivoting from an owned CI to a prod system is often comparatively easy: inject code in the next build, the artifact is implicitly trusted (hey, it’s from a known-good source) and bang! Prod owned. Or developers expose their ssh keys via agents to dev systems, the same key works for prod and you might be in.

I share your curiosity :)