Pretty sure nation-state actors are breaking things at a much lower level, like the encryption layer, which would enable a much greater harvesting of info. To me, this seems more like incompetence. If the standard is so broken that it’s obvious to an outside observer, I’m guessing an MBA did a cost-benefit analysis somewhere and decided the OSDP standard was “good enough” for its intended purpose.