What if there were lots of of successful hacks and this just happened to be the outlier because an admin was online and looking at the system at the exact moment the hack occurred?

Any large adversary would compile a huge number of ways to disable infrastructure, then use them all at once, rather than one at a time.

The quote "When Russia or China decide to do damage to our infrastructure, they will almost certainly succeed," already made that point though.