It's worth stressing that Deloitte is not a cyber security firm primarily. It's actually much worse (for them): they're a Big 4 audit company [1].

The fact that they are such a company both explains the situation and makes it worse. First, one should realize that 99.8% of people working at these companies don't know the first thing about cyber security. The 0.2% of people that do might actually be really good [2] but these consultancies don't tend to put their employees on improving the internal state of affairs.

Second, attackers getting access to security-related material might be bad, but it will be much worse for Deloitte if people get access to the financially sensitive data that the majority of their employees work on. Not only can this be more directly damaging to their clients, this data and the responsibilities around it are affected by many more laws and regulations.

[1]: https://en.wikipedia.org/wiki/Big_Four_accounting_firms

[2]: This typically also depends on which local franchisee of the Big Four brand you're talking to, but let's not go down that rabbit hole.