This was a dev who wanted to sync data between their home and work computers so they could do check-ins from home. This is a combination of a lazy person who values their own ease of use over basic security practices, plus a government contractor who values making as much money as possible by paying shitty devs without any real oversight over those shitty devs, plus an oversight government entity that had its funding slashed by people who only understand cutting money as opposed to national security.

I’m sure that will be an excuse but no, this was lazy-ass we-dont-wanna incompetent garbage devs.

Odds are neither and it’s a “plausibly deniable” attack.