> I’d expect they have at least decent security protocols in place.

Don't expect too much from the government :)

The U.S. government actually provides a lot of really awesome free security resources and I believe they implement a lot of security measures. One of my favorite security resource provided by the govt. is STIG[1]. If you take your time to implement the measures outlined in STIG in your network it would be EXTREMELY difficult (in my opinion) to break into your network/devices without a zero-day or other undiscovered exploit.

I have not worked for the govt, so I do not have a first-party understanding. And I doubt any entity is impervious to simple/well-known attack vectors (such as EternalBlue) but my experience with STIG as a security engineer has always left me really impressed with the level of research and suggestions the government provides to the public -- for free.

[1] https://public.cyber.mil/stigs/

They also do this while other parts of the government have their budgets gutted. How do they pay IT to implement security?

Parts of the government related to national security are pretty well funded.

Fair enough, I don't really have first-hand experience with government IT positions so I don't have much to add with how the government implements security.

There's a reason the most sophisticated attacks usually come from "state actors".