This really shouldn't be a surprise ... the attack surface is too large, there are too many privileged people, not enough silos and ... it's the government. If they were more careful to get their money's worth, they'd find that they had to develop more stringent specifications, which would also lead to a more careful analysis of the problem.
When you hack all day, train people to hack all day, hire companies like Booz who admitted they didn't check out their employees and reward them with billions more in work - yea your not going to stop anything. I just hope more people do it.