I think his point was _precisely_ that it was a stupid mistake on his part, and not a 'master hacker' subverting his defences. But I agree it's odd that he doesn't seem to have heard of defence in depth, and relied entirely on one UFW rule as opposed to also setting a password on Mongo and/or (preferably) configuring firewalls on the cloud provider level.

Yeah, downplaying the guy who hacked you doesn't make it any better.

Actually it makes it worse, since your security is so bad that any "script kiddie" can hack into your system.