The article has a screenshot of the decompiled code showing that they're just running the downloaded executable immediately, without any additional checks on the content.

A manager somewhere made the embarrassingly wrong decision to not fix this, and they’re too egotistical to correct their mistake.

That’s my take.