I'm sure there was some incompetance at the individual level, but I think it's more likely that the key issue was that the management de-prioritized security, which lead to the IT team either not having staff on hand to fix issues that came up, or being assigned tasks other than fixing the security issues.

In that case, ruining the career of a low-level employee seems misplaced, especially when they most likely weren't the cause of these issues.