The Salt Typhoon wasn’t a Hollywood breach. Attackers used years-old holes in common internet gear — some dating to 2018 — and sat inside parts of telecom and government networks for nine to 18 months. No fancy tools. The miss was basic upkeep.