Yep. You train a lot of app pentesters and you get used to warning them: do not try this at home. You know you can just edit a URL in your browser by just a couple characters and poof be an admin. It should would be interesting to find out what it's like to be an admin on this site... oh, wait, if I do that I might end up talking to a prosecutor.

That's obviously not a normative description. I don't think it's good that the world works like that, although I probably blame different people than most of HN.

Anyways, point being: the assumption that a very smart person wouldn't dream of breaking into a government server: does not at all square with my experience. Doesn't make the assumption wrong; it's just a data point.