This is why I don't understand all the funding that goes into cyber security research and related technology: in so many cases, the technology is not even the weakest link.
Of course, it all comes down to organizational issues in the end (they knew about the risk and ignored it), but this seems like exactly the kind of thing that politics want to prevent when they throw around money for "cybersecurity".