I'd say a dedicated hacker could walk through their system like a laser through butter anyway. After all, it's just a random school, lacking expertise as also manpower for proper quality. Their long term goal should be to get the same experience from a proper managed project. The problem is that official projects have just started to move into that space. German Public IT is insanely far behind in that regard.