For one thing, they had static routing tables in place on a per port basis, and this was very finely gone over. Not counting all the other layers of protection in place, it was the case that flat out the consumer focused networking gear was not able to get packets routed over to any critical systems.
At the time, our threat assessment was "Osama Bin Laden gets on board with a laptop".
IIRC, and it has been quite a few years (the better part of a decade!), the few hardwired ports that did have access to more critical systems could only be used by laptops that had certificates on them providing authentication. Without that, even the ports that DID have the potential for routing to more important systems on board would get all their traffic forwarded to /dev/null.