I highly doubt, if they even had a dedicated "security team" at the time the platform was architected as such, that they would have told the rest of the company they "had best-of-breed security". They would have understood their shortcomings and communicated them up the chain of command. And firing them and hiring an outside team of "security experts" to re-architect their system wholesale would be a patently absurd course of action.
The form of responsibility taking you're demanding is actually just business as usual, reactionary scapegoating.
The form of responsibility taking you're demanding is actually just business as usual, reactionary scapegoating.