I've reached that point where I see flaming headless chicken responses to completely predictable digital/network/cyber security failures with the same kind of energy as every other, "I told you not to do that" thing in my life.
Leave your shit exposed directly on the Internet? Check.
Keep your legacy systems running end of life code? Check.
Skip formal verification of mission critical software? Check.
Bundle up credentials from all around the world with no way to check them? Check.
Use your last line of defense as your only line of defense? Check.
Bingo!