> None of the steps taken in response addressed the fundamental, obvious security policy issues. Even their band-aid fixes were broken.

I feel like it is a universal truth of engineering, that you can't expect anyone who implemented such a grossly broken system in the first place to be capable of anything but band-aid fixes of the specific flaws pointed out to them.