Having employees (or system like bastion hosts) with unrestricted access is one of the recurring mistakes in such events. I can’t understand it.
Zero Trust is expensive to implement and the business people hear "at the end, the systems will ideally work as good as before".
It will take a few bankruptcies until security is taken seriously.