You assume anyone except the hacker knew anything about AWS.
Our firm subcontracts to other firms. I am among other thing resident Sysadmin which means I get to do everything related to AWS.
Out of 6 contracts we had, where firm had their project on aws I got root credentials in 4 cases. out of 4 i only managed to convince 2 to take their account security more seriously and lock things down.
What I am trying to say is that what happened at Ubiquiti is far more comon than people realize.
Because when all is said and done you still need someone who thinks like sysadmin.