As a network admin I have to get approval and funding from management to implement many security measures. In this case it *seems* as if the fired employees had tried to secure the funding for security measures on multiple occasions, but been shot down. It's fine and dandy to say it's our job to make the network secure, but without the $$$ and management backing we're often forced to make do with less than perfect solutions.