You can't easily "bolt on" security to a massive internal ecosystem of insecure projects that has built up over the years. If I had to guess, I would anticipate the software T-Mobile is running includes a lot of legacy that hasn't been fully maintained. If they don't spend the cash to retain developers who built these projects or to keep them maintained, it means there's nobody around who really knows the codebase. And that means funding the little security edge cases is going to be nearly impossible, particularly for an external contractor with a few months.