> She's wrong to imply that if only SolarWinds had followed her iPad password policy, the attack would have been stopped.

I don't think she was implying that at all. She was highlighting that if they couldn't even do a basic thing like employing stronger, more complex passwords - how could they defend against Russians reading DoD emails.