I think btown's sibling comment has it right. It's not even a prototype if it isn't demonstrating some aspect of its core capabilities.

Given this line from the article:

    Despite the early September memo’s scathing critique, Leonel Garciga, Army chief information officer and Chiulli’s supervisor, said in a statement to Reuters that the report was part of a process that helped in “triaging cybersecurity vulnerabilities” and mitigating them.

and

    Other deficiencies highlighted in the memo include the hosting of third-party applications that have not undergone Army security assessments. One application revealed 25 high-severity code vulnerabilities. Three additional applications under review each contain over 200 vulnerabilities requiring assessment, according to the document.

it seems like there was a SIGNIFICANT mismatch in expectations between the team delivering the prototype and the people receiving it. Everyone's time was wasted as a result.

Yup, that's the job of the folks at Fort Carson: find the flaws in the prototype. I often hear and feel the booms when they are testing. The percussive shocks travel many miles through the shale to under my house.

Bolting on security after the fact is not exactly the preferred strat.

Especially when the cost of busted security in this context is “exceptionally grave damage.”