re "Astros' staff brought this on themselves": A predictable outcome doesn't make it an acceptable outcome. They should have taken security more seriously, but that doesn't in any way excuse the Cardinals for exploiting them.
Well, if your network is open to the public and not properly secured, that's on you. Especially multi-million dollar organizations that can afford to pay security experts.
Bad or no security is not in itself permission to enter.
Yes, the Astros do bear some responsibility to make sure things are not easily accessible. That doesn't change the fact that what the Cardinals did was wrong.