With a much larger pool of potential actors, it's more difficult to conclusively assume that exactly one actor is behind all of the hacks to the exclusion of all others.
The argument that Russia did it has never been that "only a nation state could do it" (which would leave lots of possibilities besides Russia).
It was that forensic analysis revealed specific indicators of specific threat groups that have been previously identified as being operated by specific components of the Russian government being the parties involved in the attacks. Motive is also a factor.
I mean, yeah, the door being unlocked means anyone could have gotten in without breaking it down and killed the guy, but its kind of natural to zero in on the guy whose fingerprints were on the knife and who had a motive to commit the murder.
What would you say if a guard let a foreign spy walk into the pentagon? Blame the spy?
Yes, you don't get immunity from espionage if the job was easy.
Yes, the Democrats servers may not have been well secured.
How does that affect the issue of whether or not the Russian state was responsible for the hacking or sought to influence the election?