We don't know how the companies were compromised, so we have no way of knowing if they were capable of protecting themselves. A state sponsored attacker has effectively unlimited resources, so at the end of the day, the company would go bankrupt trying to protect themselves against every concievable attack. It's one thing if they were negligent, but just saying that they should have protected themselves better is like blaming an Iraqi company for not protecting itself from being blown up by the USA. Some threats are just too large for you to protect against.