You think Fortune 500 companies don't hire complete idiots too? They just have 5 extra people for every 1 developer to double check whether or not the developer did something stupid, test the site for obvious vulns, etc.

It's not necessarily a matter of them being cheap, good developers are hard to find, and the only people who can tell the difference are/were good developers themselves.

This is doubly true with security. There is no cosmetic or usability difference between a secure application and a nightmare that leads to thousands of leaked passwords. So companies that don't already have a good group of developers are screwed when hiring, and companies that don't consider their existing team's decision as the most important factor when hiring are asking for trouble.

This could happen to any developer. All it takes is a dumb installation package to screw up your permissions, or something similarly trivial.

Also, it's not a matter of development, but security and system administration. They are often performed not only by different people, but sometimes even by different sub-organizations in different physical locations. It's not a good excuse, but we shouldn't be so quick to judge developers author knowing what exactly happened.