There is no surprise here. The ATM companies making the machines and their software are so old school and simply outdated in terms of cybersecurity.
I'd go further than that. These companies are, demonstrably, run by total idiots.
I knew someone who worked for an ATM company back in the mid 1980s. Coordinated attacks exploiting weaknesses were routine even then!
That's right. People have been finding hacks to steal cash from ATMs for at least 35 years!
That's 35 freaking calendar years. How much is that in Internet years? :)