This isnt true in all cases and depending on the nature of the attack could be subverted as the especailly if the same policies /controls are not enforced locally. Its certainly more than a coincidence.

I think the simple answer is IT/informatics wasn’t given enough priority or was funded adequately.

You don’t have to far back on this site to see common patterns emerging (and these aren’t just IT) in a number of NHS regions and trusts.

Using local email systems instead of the national system allowing malware through.
Failing to have a proper patch / update regime.
Insufficient network controls/segmentation allowing proliferation.
Failure to properly firewall legacy devices / systems.
Not using least privileges.