I don't think the down-vote was necessary. I agree it will always look bad, and obviously they need to do better. But there's no logical inference about the qua

I don't think the down-vote was necessary. I agree it will always look bad, and obviously they need to do better. But there's no logical inference about the quality of the work they do for clients that can be made from them not securing themselves. In particular, if they are busy and thorough with clients they may not have the time to sort themselves out. As the saying goes... Dogfooding is not so appropriate, regular testing of software/cooking through continuous use is quite different to infrequent security attacks. Perhaps they are testing intrusion detection ;)