It’s easy to say in retrospect that this specific issue was a big problem and we wish someone had come forwards. It’s a lot harder for someone without the benefit of hindsight to notice that it’ll definitely need to disaster, and that it over all the other minor deviations from the rules needs to be whistleblown on. (Before the hack, how much attention would you have paid to someone whistleblowing that some of Experian’s software dependencies are out of date?)