“Properly engineered” means the principle of least privilege and fitting the sandbox to the constraints of the problem.

The test did not require internet. They gave it internet. Therefore it was not properly engineered.

We do not need to depend on all code being bug free to follow proper security principles.