It's likely that was the protocol, but it wasn't followed. It usually comes down to actions of a Pointy Haired Boss rather than some glaringly obvious hole in their security plan.