Historically, how many of these days breaches have been linked to an inside person? The answer is almost none. Your first point is correct that someone (s) was likely was negligent, but your second point is tin foil bullshit. Maybe if there was any indication of foul play, the accusation has merit, but there’s been none. Like almost all other breaches, it was likely a third party.