Global picture
They found this at NASA because they studied NASA. Substitute any government agency and they likely would have found the same thing. Substitute any large company and, again, they would likely have found the same thing.
Too often, security efforts focus on high value assets while ignoring public facing assets without realizing their potential as attack vectors.
Too often, this is a management choice in order to reduce costs.