EAS was designed in the late eighties, when infosec was not a well-established, household-name field. It works by relaying an unencrypted signal; that rather unsettling data burst you hear when there's an Amber Alert or a thunderstorm warning. There's no authentication on this. There's no encryption. Literally anyone with software to generate NOAA SAME tones, together with a software-defined radio and amplifier, can walk near one of a handful of "primary entry points" and belt out an alert that gets mindlessly repeated across the country. It's already happened on a local level by simply logging into network-connected endecs at TV stations; probably none of them changed the default passwords.
Every day I see something like this, I'm reminded of why anyone still considers security-by-obscurity to be a sound strategy. State actors are the prime target of vulnerabilities you call obscure.