I disagree. The "this" that happened on his watch was not, in my opinion, that there was a breach, but rather the shitstorm about how it was handled - this happened on his watch and he did not handle it well and that is what makes him a bad CEO in my opinion.

Things happening isn't necessarily an indicator that the person is bad, but how they deal with it (in this case, he didn't for many months!) is an indicator. That's not an impossible standard to reach.