About twenty years ago, I was privileged to be one of the authors of a security specification written at the behest of cable-based telecom companies that described the detailed design of a system for securing phone conversations that were carried over their networks. https://www.cablelabs.com/spec.... The design specifically started with the assumption that the network was penetrated, and was designed to ensure that the attacker could neither disrupt service nor learn anything useful about the traffic (for example, taken from the specification: "All media packets and all sensitive signaling communication across the network [are] safe from eavesdropping. Unauthorized message modification, insertion, deletion and replays anywhere in the network [are] easily detectable and [do] not affect proper network operation").
Once the specification was completed and it came time to deploy, all the telecom companies decided (whether in concert or individually, I do not know) that they were not going to deploy the design. When the lead security VP at one of the major telecom companies explained their decision to me: "We don't need gold-plated security like you've designed: we have firewalls"; I knew that the battle was lost. I also wondered how long it would be before the kind of intrusion like the one described in the article would occur.
Frankly, I'm amazed that it took this long; perhaps, though, what took the time was not the fact of a thorough intrusion, but, rather, the detecting of one.