If attacks of this nature are possible, they will happen. The problem is that they are possible. There is no excuse for the state of security - either in software or administration, or both - that leaves these vulnerabilities waiting to be exploited.
They opt for convenience instead of security... Infrastructure like this should not be able to be controlled remotely... but of course this is common sense.
