It’s not rocket science, no, and I thought the point would be clear but in fewer words - less likely is a distinctly different thing than not possible.
The specific thing that happened would not have been possible. They might have found a different exploit in the firewall system. But specifically "the package manager can be exploited to send arbitrary requests" problem could have been solved in this obvious way.