> We can only assume, then, that this effort was either underfunded, poorly managed, or both.

Pure conjecture on your part. You have no insight into their security program. The only thing you can accurately infer is that they missed this one.

The phishing site thing was pretty stupid, though, I agree.