Not sure why you're excluding Mil/IC here, in light of Bradley Manning and Edward Snowden, did you mean to restrict your point to Internet-connected devices?
Both Snowden and Manning got their information from systems to which they had been granted access. .Mil and IC targets are among the most hardened in the world, even if they were a bit lax about implementing fine-grained access control amongst their cleared personnel.
it still requires stakeholders delegating access to said individuals for different [sub]compartments.
It's a nightmare to me that there could be 15 people that have actual access to information, but a random official in the chain of command could give any one of 1.4 million people access to it without any further vetting.