If the password for your "military grade" secured infastructure is literally "solarwinds123", I wouldn't say it's a sophisticated attack.
It's a more complete picture of how much modern businesses value security or pentesting audits. The answer to that is exactly zero effs.
As long as businesses think there is no ROI in security, this will stay the same.
The only thing sophisticated about this was that from code to deployment there wasn't any single audit of anyone. And that's a bad joke by any security measurement.
If any intruder can stay undetected THAT long, I don't wanna know what's up with MSFTs infrastructure. Must be an open door for everyone, and probably still uses the Perl pre-release based pipeline.