How come their IT systems are so bad that a kid in secondary school (thus with no experience) “hacked” into them?

Because they protect against the user. Computer security has evolved: we must milk the user of its data and make sure he doen't interfere with the milking process.