What's more likely, a big pentesting company messed up this one engagement, or the state is incompetent and doesn't understand pentesting? I'm leaning towards the latter.