There are a lot of other companies that need access to those films. For example, the people doing subtitles, or printing the film, or doing digital distribution

There are a lot of other companies that need access to those films. For example, the people doing subtitles, or printing the film, or doing digital distribution. I doubt the systems that stored these movies were hacked directly, but once the password files leaked out from the main attack they were simply downloaded from their distribution servers. That's why there haven't been any leaked work in progress films, because they are being worked on from airgapped networks. It's only when a film is close to release that it is put on a system connected to the internet so that it can be distributed to partner companies.