> "Government agency is incompetent" is a very potent narrative that blocks the usual expectation that cloud products should be difficult to use insecurely.

Whether the government purchased a defective product that was insecure or misused a good product, the government should be held to account for the failure, same as with any company.