Its a bit more nuanced than that. The company responsible for ensuring the cybersecurity of the system told the press that "they secured what the client told them to secure and it was not their job to tell the client what needs to be secured".