I suspect this was a combination of lax oversight and illusory superiority - in effect an unconscious bias to believe that because the OSB considered themselves a top information-security team, they didn't need to worry about securing their own systems.