Are the authors suggesting the weak credentials were the only part of the attack? Or are they suggesting they were the first part in a rather sophisticated supp

Are the authors suggesting the weak credentials were the only part of the attack? Or are they suggesting they were the first part in a rather sophisticated supply chain attack? The credentials by themselves don’t give execute privileges, or persistence, or in fact any access to non-SolarWinds systems. So both can be true.