Because they weren't sealed. There was no access control on the system. The vendor used obscure URLs claiming they made the system "secure."

And we know how that story always plays out.

thank you. That's shocking, and also, I feel almost dumb to ask. Its government contracting, and because you are right, that's how a story plays out.