There is one defining characteristic of a company whose products are secure: the existence of a security methodology that is followed religiously. Generally that means that for everything that gets rolled out, it goes through a security department that handles security lifecycle management and brings in external security consultants to do both SARs (security architecture reviews) and AVTs (application vulnerability tests). Every single thing that touches your company's network, whether it's a third-party product or internal, should have an AVT performed before it touches a production server, and every internal product should have a SAR performed both by dedicated internal teams and external teams (this is generally a joint test, as domain knowledge that consultants may not have can be very important).

If that process isn't in place, then it's simply a matter of time (and pissing off the wrong people) before it all ends up crumbling. I don't know anything about Sony's internal processes whatsoever, but everything I've seen and heard points to this process being completely nonexistent. Most of these vulnerabilities would've been caught by anyone familiar with security -- if they're easy to find from the outside, they're downright trivial to find from the inside.

(Full disclosure: I work as a security consultant)