"Their undetected security breach was by an insider" is not the sterling defence of Ubiquiti that you seem to think it is.
Considering the nature of the attacker (and the HN comments about the guy at the time of the attack) my take away of ubiquiti from this event and their response was positive. I also down ranked my expectation of Krebs’ accuracy.
It’s not personal - he writes lots of great stuff, but his response to being wrong in this case was worse than Ubiquiti’s response to the incident.
It's like Okta. Of course it's hard to protect against an insider ( although Ubiquti didn't really try), but that's not an excuse to screw up the disclosure.
This is just more and more embarrassment for a company that clearly just doesn't understand security, and yet wants to force all their users of their products to rely on them as a trust model by making all of their ongoing product systems completely cloud reliant or at least holding third party root keys to sell ads / customer telemetry.
And yet, enterprise-level suppliers do it successfully every day.