I believe the point of exercises like this is to show that the risk of being hacked is higher than was previously thought. The easier it is to do, the more likely an attacker will pull it off when they attempt it, and for someone whose goal is to wreak havoc rather than defeat an interestingly difficult system, the more likely an attacker will make the attempt in the first place.

Certainly it could be the case that the benefit exceeds the risk, but if such calculations were made, they may need to be reevaluated.