To be fair, the last two are spearphishing attacks and so are limited to manipulating a single vote. While important, the scope of this test is to ensure that a

To be fair, the last two are spearphishing attacks and so are limited to manipulating a single vote. While important, the scope of this test is to ensure that a single actor cannot manipulate masses of votes at once to skew things heavily in one direction. The first one makes sense as they still have an important service to run outside of the scope of just voting - no one wants Swiss Post to go down for a month while they pen test because some hacker decided to bring it down.