My guess is the problems here were more banal: the account running apache had too much privilege (maybe even root?), and the vulnerability was left unpatched fo

My guess is the problems here were more banal: the account running apache had too much privilege (maybe even root?), and the vulnerability was left unpatched for a long time (weeks at least). If you can execute arbitrary commands on a web server it's essentially impossible for any architecture to keep your hands off any (or all) data that server needs access to for its normal functions.