The specific thing that happened would not have been possible. They might have found a different exploit in the firewall system. But specifically "the package manager can be exploited to send arbitrary requests" problem could have been solved in this obvious way.