The author makes the assumption it was a security breach in Drupal's CMS that was at fault but gave no insight as to why they think that to be the case.

Until I hear differently it could as easily have been a hardware or OS vulnerability that was exploited.

Even if it was a security breach in the CMS, the fact that it was an Open-source CMS does not inherently make it bad. Did the company IT dept. regularly update to the latest version? Did they modify the CMS's core code to suite their own needs? To many questions to blame it on open-source.

Comes across a bit like an "I could write a more secure CMS", post to me.