Your last paragraph is essential to making sense of this whole story. The same sentiment is also present in the original report, on page four. The institutions

Your last paragraph is essential to making sense of this whole story. The same sentiment is also present in the original report, on page four. The institutions who bought that software were like aware of those safety nets, which is why they had no problem buying from a vendor that basically looks like a two-man Delphi shop (no idea what they actually used). Had the system been more critical, we would probably be talking about a whole different set of shocking security problems, in some absurdly overengineered T-Systems monstrosity. Personally I feel less unsafe with paper and the obvious insecurities of a glorified excel sheet than with a titanic money-sink twenty layers deep that is feeding an army of salespersons and lobbyists paid to silence every voice of concern. What the institutions who bought this thing underestimated is the terrible impact a caught manipulation (and even this preemptive disclosure, despite being orders of magnitude preferable to only finding out after a caught manipulation) would have on trust, and the spring time for radicals that would follow. A caught manipulation could destabilize the country more than a cruise missile hitting the Reichstag.