Having worked with large enterprise vendors, it's really not startling to me. Depressing, perhaps.

I'm saying, though, that a hack can be sophisticated even if the initial compromise was something pretty basic like this.

As an example, https://about.fb.com/news/2020/11/bug-bounty-program-10th-an...

> Earlier this year we received a report from Selamet Hariyanto who identified a low impact issue in our Content Delivery Network (CDN), a global network of servers that deliver content to people accessing our platform around the world, where a subset of our CDN URLs could have been accessible after they were set to expire. After fixing this bug, our internal researchers found a rare scenario where a very sophisticated attacker could have escalated to remote code execution. As always, we rewarded the researcher based on the maximum possible impact of their report, rather than on the lower-severity issue initially reported to us. It is now our highest bounty – $80,000.