This example is a borderline case. This means that not only they got hacked but also pip repo they were using.

Which means that their provider also did not run any dependency scans.

Tho if they fetched that from github open source repo -> yup thats just incompetence.