It is fair game to ask why the people in charge of national cybersecurity didn’t even know for 9 months that half the world had been thoroughly compromised.
Likely including them.
There’s a reason we call them “Advanced Persistent Threats (APTs).” A MAJORITY of compromises occur over the course of months. Hacks are not in-and-out operations like what you see in movies. Beachheads have to be established, reconnaissance done, lateral movement to traverse the network in search of administrative credentials, privilege escalation, takeover of domain identity infrastructure, data gathering and exfiltration. All of this takes effort. 9 months is FAST by most accounts.