I think the key phrase you are missing which is repeated many places in the timeline is “Engineering was not consulted”. His failure wasn’t that he doesn’t know the entire system, it was that he kept engineering in the dark, “investigated” on his own, and made conclusions to disregard the persistent researcher who kept banging at the door saying “there is an issue” despite him disregarding it again and again, notably without consulting engineering.
You don’t need to know the entire system as CISO, but you certainly do need to know that you don’t know the entire system as CISO. This wasn’t an institutional failure, it was a personal failure at a very high level.
I’m not arguing that the guy had to resign, merely pointing out that the narrative used to argue against his resignation is flawed.