The US states (and less so the federals) are woefully inept at protecting their residents
Underfunded, under-appreciated, never given a voice at the big boys table. That's the state of cyber security. Admittedly this is California who should have some savvy and budgets.
And since this needs to be repeated 50 times (for each state) and the underfunding is rampant at the state level, guess where miscreants are going to focus attention.
Add in a bunch of crazies in gov't who think that Elvis lives and Trump won in every election since Reagan, then you have a perfect petri dish to inject new pathogens.