So we don't yet know the details of the attacks but it is certainly possible that the systems that were attacked didn't patch a vulnerability identified earlier in the year.
I shared an analysis I found in another post.
In the past decade I moved from a place that took security very seriously to a place that I'm not sure even has a complete network diagram, so my expectations of competence in control system security in private companies is basically nil. It's slightly higher in some government systems only because it's a lot easier to be a tyrannical admin if people aren't really paying attention to you. But you gotta luck out and have the right person in the role.