I'm wondering why they didn't consider this scenario in the first place. That lets me question their expertise very much. Aren't they professionally paranoid enough? Then why do they run critical infrastructure?
Now risk is perceived to be higher, cost is a little more flexible.
Businesses don't necessarily operate in the best interests of their clients. The shareholders come first, then the clients and anything which takes from the bottom line is going to end up a risk tradeoff.
I post anonymously as I'm risk averse and don't necessarily agree with how businesses operate in this respect.