Not expecting someone to war drive a drop table query into an EZ pass database isn’t incompetence, n’or is not expecting any other vulnerability to be exploited unless you have specific training to look out for it.
Even master defensive coders won’t be able to write something that’s impenetrable, just difficult enough to break into that it isn’t worth it to 99.99999% of attackers.