RSA Hack and lessons learned

In May, Wired published a story about the RSA hack. Reddit covered it. One part stood out for me: how the supposedly air-gapped seed server was not only not air-gapped at all, but it was set up incorrectly allowing incoming connections (instead of much more secure outgoing connections only):

[O]ne server on RSA’s internet-connected network was linked, through a firewall that allowed no other connections, to the seed warehouse on the manufacturing side. Every 15 minutes, that server would pull off a certain number of seeds so that they could be encrypted, written to a CD, and given to SecurID customers.

It baffles me, that RSA thought that was good network security back then, or that they were watching the hacking in real time, instead of shutting the whole thing down right away.