Still there are IMHO limits, this story appears to me "too easy".
From the article:
>The manufacturing facility looked like a prison. No windows, heavy iron gates, no landscaping. Generally a monstrosity of architecture.
>This facility had armed guards, badge readers, biometric security controls and turnstiles at every entrance.
The above implies that the firm is attempting to have a higher level of security than most offices/factories.
I would have expected that the pentester had to do something more than what she wrote.
I mean, you first put up some basic security/access policies, and later you hire someone to test them.
And I cannot believe that:
>I gained network access and stole several thousands of dollars in physical primitives by picking my way through cheap locks.
One thing is getting access to the premises, another one is managing to be left alone and allowed to have network access, start lockpicking locks, etc.