> If we assume that Ms. Thompson is generally terrible at opsec, then presumably she is also terrible at offensive security,

One can possess great technical skills and still be a braggart. Nothing about a lack of OPSEC implies she cannot exploit a vulnerable system.