Hm. Should I state the obvious? If the individuals are part of the system, then the whole system is compromised. Or as the saying goes “security is only as strong as the weakest link,” and someone put those “individual links” out there without enough vetting.
So, yes, it was the mistake of the overall security.