I don't think Palantir should be shamed for this. It's laudable that they invested in penetration testing - better they find out this way than by an actual APT/hacking group.
I don't think they should be lauded for doing their jobs and discovering they failed at them. If your QA team discovers huge numbers of bugs, you don't laud yourself for doing QA.
If a leading accounting firm hires an outside auditor and discovered their own books were rotten, should they be lauded? I guess there's a silver lining in everything.
I guess I'd be willing to trust Palantir's advice on hiring penetration testers, but not on securing my systems.
It is not a reasonable expectation that software, even security software or software developed with security expertise, is secure.
Chances are, it was leaked by a disgruntled employee. But the fact is that the red team started on the internal network and used tactics that would work on darn near every org these days.
Palantir is no different. The only issue is that their pentest report was leaked.