It was a 0day in a popular open source package. They didn't do anything wrong. Presumably they use stronger defense in depth, as required by the CA guidelines, to prevent software compromises to the actual CA signing machines. There's no need to go through that level of paranoia for CT log machines.