I think the point would be that it's the private company's responsibility to provide a minimum level of security, even if their job is just for deterrence, documentation, and notifying police in a timely manner. Even if it's mostly "theatre" it still serves a purpose.

Even more in this case: The business Starlink is operating is classified as critical infrastructure (in both EU and US)

As providers in the business of critical infrastructure they need to comply to the HIGHEST physical and digital security requirements, which includes taking preventive measures against acts of terrorism.

Not much is known about this case yet though, it's possible that their preventive procedures failed but their resilience procedures worked (was Starlink down?), and they reported the incident in compliance to EU CER and NIS2.

Either way, I'm sure they'll get an audit for EU CER compliance now, which will create a list of mandated immediate actions...